Splunk Search

Why does the index order change the amount of results returned by inner join and why are large amounts of data missing?

LWilliamson1
Explorer

Search:

index="A" |dedup Id | table Id | join max=0 type=inner Id [search index="B" ]| stats count(Id)

When switching index A & B, I receive more results, but it still doesn't match all of the Ids.
After checking both indexes and doing analysis on the Ids, it was found that over 6000 Ids didn't join, even though they existed in each data set.

0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

Are you hitting any of these default limits (from limits.conf), most likely, does your subsearch return more than 50000 events?
[join]
subsearch_maxout = 50000
subsearch_maxtime = 60
subsearch_timeout = 120

?

BTW, you also may want to remove the table Id or replace it with fields Id (unrelated, but more efficient).

View solution in original post

s2_splunk
Splunk Employee
Splunk Employee

Are you hitting any of these default limits (from limits.conf), most likely, does your subsearch return more than 50000 events?
[join]
subsearch_maxout = 50000
subsearch_maxtime = 60
subsearch_timeout = 120

?

BTW, you also may want to remove the table Id or replace it with fields Id (unrelated, but more efficient).

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...