Splunk Search

Why does the index order change the amount of results returned by inner join and why are large amounts of data missing?

Explorer

Search:

index="A" |dedup Id | table Id | join max=0 type=inner Id [search index="B" ]| stats count(Id)

When switching index A & B, I receive more results, but it still doesn't match all of the Ids.
After checking both indexes and doing analysis on the Ids, it was found that over 6000 Ids didn't join, even though they existed in each data set.

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Are you hitting any of these default limits (from limits.conf), most likely, does your subsearch return more than 50000 events?
[join]
subsearch_maxout = 50000
subsearch_maxtime = 60
subsearch_timeout = 120

?

BTW, you also may want to remove the table Id or replace it with fields Id (unrelated, but more efficient).

View solution in original post

Splunk Employee
Splunk Employee

Are you hitting any of these default limits (from limits.conf), most likely, does your subsearch return more than 50000 events?
[join]
subsearch_maxout = 50000
subsearch_maxtime = 60
subsearch_timeout = 120

?

BTW, you also may want to remove the table Id or replace it with fields Id (unrelated, but more efficient).

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!