Splunk Search

Is cartesian product not possible in splunk using join?

asingla
Communicator

I am using a join search command. What I noticed is that join only takes one row from the sub search result for the joining field though my subsearch has more than one row on the joining field.
In short it's not doing the Cartesian product as done by joins in SQL.

e.g. search result for the outer search is

host

host1

host2

and subsearch return the following

host instance status

host1, 1, ON

host1, 2, OFF

host2, 1, OFF

the join on host returns

host1,1,ON (or host1,2,OFF)

host2,1,OFF

Is there anyway to get the Cartesian product in splunk?

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You need to set the max parameter on the join command to something higher than the default of 1: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join

Also, I would suggest, depending what you're doing, that you'd be much better off using either a subsearch or a lookup if possible, as they are much more efficiently implemented in Splunk than the join command.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

You need to set the max parameter on the join command to something higher than the default of 1: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join

Also, I would suggest, depending what you're doing, that you'd be much better off using either a subsearch or a lookup if possible, as they are much more efficiently implemented in Splunk than the join command.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...