Need clarification for the 3 options of the join command

[email2vamsi]

Could you please explain the following three options of join?

I could not understand them.

usetime
Syntax: usetime=<bool>
Description: A Boolean value that Indicates whether to use time to limit the matches in the subsearch results. Used with the earlier option to limit the subsearch results to matches that are earlier or later than the main search results.
Default: true

---

earlier
Syntax: earlier=<bool>
Description: If usetime=true and earlier=true, the main search results are matched only against earlier results from the subsearch. If earlier=false, the main search results are matched only against later results from the subsearch. Results that occur at the same time (second) are not eliminated by either value.
Default: true

---

overwrite
Syntax: overwrite=<bool>
Description: Indicates whether fields from the subresults overwrite the fields from the main results, if the fields have the same field name.
Default: true

[woodcock]

BTW, there is almost always a better way to do what you need to do than using join. Go here and look at the March 2016 session:
https://wiki.splunk.com/Virtual_.conf

[gcusello]

Hi email2vamsi,
the first two are to be used together to limit results (when they are both true) of the main search: they are matched only against earlier results from the subsearch.
About the third: if you have the same field name in both the searches but different values, in your results you'll have only the main search values, values of second search are overwritten an not showed.

Bye.
Giuseppe

[email2vamsi]

In join how many sub-queries can be run?
If yes,the syntax remains the same?

Can the following be done?
index="index2" sourcetype="sql-production-response" | join running_ok
  [search index="index2" sourcetype="sql-production-monitor" ]  | join running_ok
  [search index="index2" sourcetype="sql-production-action" ]

[gcusello]

I didn't try more levels of sub-queries (only two levels of sub-queries), but I don't think that there is a real limit, the only one is probably the time execution because you overload your search.
About the syntax, I think that it's always the same, but options are relative only to the search in which you inserted options and the first sub-query, I don't think that it's recursive.
Bye.
Giuseppe