how to avoid join

[vikashperiwal]

Hi, 

I have scenario where index and sourcetype are same and i am tryng below conditions.

chart dc(run) OVER app by event---- this will give me dc of run for each app for each event

stats dc(run) as run by app-- this will give me dc of run by app........

i used join to get this done ike below, but this is taking lot time to run query,

base search...
|chart dc(run) OVER app by event
| join app
        [search source =mysource | stats dc(run) as run by app ] 
|eval new_val = run - event1- event2 
| fields app event1 event2 new_val new run

[thambisetty]

You can use append command to avoid join.

like the way you did join based on field app.

you can achieve same from append command.

example search is as below:

| search1 | stats count as count1 by app run

| append [search2 | stats count by app run1]
| stats values(*) as * by app

| do what ever you want

[vikashperiwal]

The below sol would not filter by event and 2 nd app/join both are taking lot of time to run, do we see any alternative of this, 

[thambisetty]

do not append all your raw events. you should append processed results from second search. this way you can improve the performance of search.