Splunk Search

Return "No result" when joining two tables if the subsearch has too many records

kelvin56887
Explorer

The query is as follows:
index="inverntory" source="s1" UUID="C64" | join UUID [search index="inverntory" source="s1"]
**This query is a simplified version so please don't ask me the reason for doing this kind of join.

1. The subsearch [search index="inverntory" source="s1"] has huge set of results
2. <<<<< index="inverntory" source="s1" UUID="C64" >>>>>> => Return 1 row

However, it always return "No result".

But for
index="inverntory" source="s1" UUID="C64" | join UUID [search index="inverntory" source="s1" UUID="C64" ]
OR index="inverntory" source="s1" | join UUID [search index="inverntory" source="s1" UUID="C64" ]
They can return results.

Anyone knows WHY?

0 Karma
1 Solution

aweitzman
Motivator

Subsearches are limited (max is 10500, I believe) in the number of results they can return to the main search. If your "needle" isn't in the part of the "haystack" that gets returned, you may see no results in that case.

By flipping it, you have made it so the subsearch only has 1 result, which is easily applied to the main search, and you get the result. The main search is not limited the way the subsearch is.

Read about subsearch limits here: http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutsubsearches

View solution in original post

linu1988
Champion

50000 is the subsearch limit. it will return the results but they should be partial if you are actually providing the proper joining criteria.

aweitzman
Motivator

Subsearches are limited (max is 10500, I believe) in the number of results they can return to the main search. If your "needle" isn't in the part of the "haystack" that gets returned, you may see no results in that case.

By flipping it, you have made it so the subsearch only has 1 result, which is easily applied to the main search, and you get the result. The main search is not limited the way the subsearch is.

Read about subsearch limits here: http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutsubsearches

View solution in original post

aweitzman
Motivator

@linu1988 is right about the join subsearch limit (as opposed to the standard subsearch limit). That 50000 limit is mentioned near the bottom of the page I pointed to.

0 Karma