Splunk Search

How would I be able to improve the following joined query?

brc55
Explorer

Learning about joins and sub searches. What's the following query executing and would there be a way to make it more efficient?

index=old_indexstats count values(d) as d by username | join type=inner username [search index=new_index | stats count by username ]

I believe it starts by searching and counting usernames in the new index however, am getting mixed up after that.

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The first step in the query is to count all events and list the unique values of field 'd' for all usernames in old_index.  The second step is to count all events for each username in new_index.  Finally, the two sets of results are merged based on common username values.  If there is no match, the count from new_index is retained.

Here's one alternative query that should be more efficient.

index=old_index
| stats count as old_count values(d) as d by username 
| append [search index=new_index | stats count as new_count by username ]
| stats values(*) as * by username
---
If this reply helps you, Karma would be appreciated.
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...