Splunk Search

How to combine a search with a data model without the JOIN operator?

christopherwern
New Member

Hi experts,

I try to combine a normal search with a data model without the JOIN operator, because of the slow processing speed and the subsearch result limitation of 50.000 results per search.

I read in the .conf 2016 session by Nick Mealy (https://conf.splunk.com/files/2016/slides/let-stats-sort-them-out-building-complex-result-sets-that-...) that this not possible because the data model command is a generating command. 😞

Does anybody has a solution or face the same problem? I think it is really important to combine a data model and normal searches in a efficient way.

Kind regards,
Christopher

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

There are a number of strategies. The top two are multisearch and append.

MULTISEARCH

| multisearch
    [ search with all streaming distributed commands]
    [ | datamodel search with all streaming distributed commands]
| rename COMMENT as "Commands that are not streaming go here and operate on both subsets."

APPEND

my first search 
| append [| my datamodel search ]
| rename COMMENT as "More commands that operate on both subsets."

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

There are a number of strategies. The top two are multisearch and append.

MULTISEARCH

| multisearch
    [ search with all streaming distributed commands]
    [ | datamodel search with all streaming distributed commands]
| rename COMMENT as "Commands that are not streaming go here and operate on both subsets."

APPEND

my first search 
| append [| my datamodel search ]
| rename COMMENT as "More commands that operate on both subsets."
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...