Why does the index order change the amount of results returned by inner join and why are large amounts of data missing?

[LWilliamson1]

Search:

index="A" |dedup Id | table Id | join max=0 type=inner Id [search index="B" ]| stats count(Id)

When switching index A & B, I receive more results, but it still doesn't match all of the Ids.
After checking both indexes and doing analysis on the Ids, it was found that over 6000 Ids didn't join, even though they existed in each data set.

[s2_splunk · Accepted solution]

Are you hitting any of these default limits (from limits.conf), most likely, does your subsearch return more than 50000 events?
[join]
subsearch_maxout = 50000
subsearch_maxtime = 60
subsearch_timeout = 120

?

BTW, you also may want to remove the table Id or replace it with fields Id (unrelated, but more efficient).