Return "No result" when joining two tables if the subsearch has too many records

[kelvin56887]

The query is as follows:
index="inverntory" source="s1" UUID="C64" | join UUID [search index="inverntory" source="s1"]
**This query is a simplified version so please don't ask me the reason for doing this kind of join.

1. The subsearch [search index="inverntory" source="s1"] has huge set of results
2. <<<<< index="inverntory" source="s1" UUID="C64" >>>>>> => Return 1 row

However, it always return "No result".

But for
index="inverntory" source="s1" UUID="C64" | join UUID [search index="inverntory" source="s1" UUID="C64" ]
OR index="inverntory" source="s1" | join UUID [search index="inverntory" source="s1" UUID="C64" ]
They can return results.

Anyone knows WHY?

[linu1988]

50000 is the subsearch limit. it will return the results but they should be partial if you are actually providing the proper joining criteria.

[aweitzman · Accepted solution]

Subsearches are limited (max is 10500, I believe) in the number of results they can return to the main search. If your "needle" isn't in the part of the "haystack" that gets returned, you may see no results in that case.

By flipping it, you have made it so the subsearch only has 1 result, which is easily applied to the main search, and you get the result. The main search is not limited the way the subsearch is.

Read about subsearch limits here: http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutsubsearches

[aweitzman]

@linu1988 is right about the join subsearch limit (as opposed to the standard subsearch limit). That 50000 limit is mentioned near the bottom of the page I pointed to.