Splunk Search

Three Join Splunk query

benj851
Explorer

Hello; 

I understand joins are expensive in Splunk. When I have a query that has two joins, which query executes first? Asking because I want the most limiting subsearch to execute, followed by a second subsearch, then the main search. 

Ex. 

index=app host=foo Dataquery1
| join type=inner 
[ search index=app host=foo | table Dataquery2.Result1]
| join type=inner 
[search index=app host=foo | table Dataquery2.Result1, Dataquery3.Result1]
|  table Dataquery1.Result, Dataquery2.Result1, Dataquery3.Result1

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @benj851,

sorry but I don't understand whar you really want to know.

Anyway, the search execution order is from left to right, so the main search is always executed as the first.

Only one question, maybe the search sample you inserted in your question isn't real, but if this is your search, you don't need to use join, you could use a simpler search:

index=app host=foo Dataquery1
| table Dataquery1.Result, Dataquery2.Result1, Dataquery3.Result1

If you could share your real search, mayby we could help you better.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...