Subsearch Help

[shri_27]

[subsearch]: Subsearch produced 50000 results, truncating to maxout 50000.
How to fix this??please help

Thanks in advance.

[jonuwz]

So an inner join only matches if supplierid is present in both searches, and contractId from the subsearch will overwrite the result from the main search.

Try something like this :

(sourcetype="csv-37" NOT "suplierID" NOT "----*") OR ( sourcetype="csv-31" ) 
| stats dc(sourcetype) as types by suplierID,contractID | where types > 1
| table suplierID,contractID 

[shri_27]

sourcetype="csv-37" NOT "suplierID" NOT "----*"| table suplierID,contractID | join suplierID[search sourcetype="csv-31" | fields suplierID,contractID] | table suplierID,contractID

[jonuwz]

That error should probably read "You're doing it wrong". Post your search. I've never encountered a real world problem where a subsearch is required.