Splunk Search

combine 2 search result without using |join



I am currently have 2 tables:
date, common-granularity, groupId-1, value-1

date, common-granularity, groupId-2 ,value-2

I want to do some intermediate stats_operations such as:
|stats latest(value-1) as latest_value1 by date, common-granularity, groupId-1
|stats count(latest_value1) as count_value1, sum(inter_value1) as sum_value1 by date, common-granularity

|stats count(value-2) as count_value2 by date, common-granularity

Ideally, I want to do stats operation on Table-1 and Table-2 separately, and then combine the operation results based on date, common-granularity.
For example, the expected final result is like:
date, common-granularity, intermediate_result_from_table_1(count_value1, sum_value1), intermediate_result_from_table_2(count_value2)

I knew |join with sub-search can achieve this, but I am concern about the |join max-out limitation.
So I am looking for any possible other methodologies.


0 Karma


Hi ,

I had answered similar query few days ago. Here is my answer , you can use multiple aggregate functions

You can use the same search for these optimization issue.
I prefer to write it like this.

 | stats dc(yourfield) count(eval(anotherfield=fieldvalue)) by other field names


@zztc2004 you can explore multisearch command or union command, which will not run into subsearch limitations depending on your use case. However, for the community to assist you better, you might have to add some sample values(mock/anonymized data) for your two events you want to correlate.

| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...