Splunk Search
Highlighted

Return "No result" when joining two tables if the subsearch has too many records

Explorer

The query is as follows:
index="inverntory" source="s1" UUID="C64" | join UUID [search index="inverntory" source="s1"]
**This query is a simplified version so please don't ask me the reason for doing this kind of join.

1. The subsearch [search index="inverntory" source="s1"] has huge set of results
2. <<<<< index="inverntory" source="s1" UUID="C64" >>>>>> => Return 1 row

However, it always return "No result".

But for
index="inverntory" source="s1" UUID="C64" | join UUID [search index="inverntory" source="s1" UUID="C64" ]
OR index="inverntory" source="s1" | join UUID [search index="inverntory" source="s1" UUID="C64" ]
They can return results.

Anyone knows WHY?

0 Karma
Highlighted

Re: Return "No result" when joining two tables if the subsearch has too many records

Motivator

Subsearches are limited (max is 10500, I believe) in the number of results they can return to the main search. If your "needle" isn't in the part of the "haystack" that gets returned, you may see no results in that case.

By flipping it, you have made it so the subsearch only has 1 result, which is easily applied to the main search, and you get the result. The main search is not limited the way the subsearch is.

Read about subsearch limits here: http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutsubsearches

View solution in original post

Highlighted

Re: Return "No result" when joining two tables if the subsearch has too many records

Motivator

@linu1988 is right about the join subsearch limit (as opposed to the standard subsearch limit). That 50000 limit is mentioned near the bottom of the page I pointed to.

0 Karma
Highlighted

Re: Return "No result" when joining two tables if the subsearch has too many records

Champion

50000 is the subsearch limit. it will return the results but they should be partial if you are actually providing the proper joining criteria.