what does "join type=left _raw" actually do when i use it between 2 different searches?

[pavanae]

I am just curious to know what does it actually doing in a big splunk quary?

As per the result i understood if we use join it joins the query.

[koshyk]

it depends on your dataset. If the dataset is huge, i wouldn't use join but two searches with a NOT. if you give example of your dataset, it will be helpful to answer

[DalJeanis · Accepted solution]

| join type=left means that the stuff coming into the left side (through the pipe symbol) will be matched and kept, whereas the stuff coming in from the subsearch on the right side will only be kept if it matches the left side. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join

The field _raw is the underlying data in its raw form. Per the documentation, it "contains the original raw data of an event." http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Usedefaultfields

One of the non-obvious results of the join will be that, if a record is found on the subsearch (right) side of the join, then (per default overwrite=true) the values for all fields found on the right branch will overwrite the values by the same names from the left branch. for any matching records.

[woodcock]

It also means that your search is almost guaranteed to fail SILENTLY in the future as the joined dataset approaches the inescapable ~50K-event dataset size limit. Do not use join in Splunk for anything other than an ad-hoc search where you know your datasets are small. If you have a saved search using join, then you have created a time-bomb for somebody at some point.