Splunk Search

what does "join type=left _raw" actually do when i use it between 2 different searches?

pavanae
Builder

I am just curious to know what does it actually doing in a big splunk quary?

As per the result i understood if we use join it joins the query.

0 Karma
1 Solution

DalJeanis
Legend

| join type=left means that the stuff coming into the left side (through the pipe symbol) will be matched and kept, whereas the stuff coming in from the subsearch on the right side will only be kept if it matches the left side. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join

The field _raw is the underlying data in its raw form. Per the documentation, it "contains the original raw data of an event." http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Usedefaultfields

One of the non-obvious results of the join will be that, if a record is found on the subsearch (right) side of the join, then (per default overwrite=true) the values for all fields found on the right branch will overwrite the values by the same names from the left branch. for any matching records.

View solution in original post

0 Karma

koshyk
Super Champion

it depends on your dataset. If the dataset is huge, i wouldn't use join but two searches with a NOT. if you give example of your dataset, it will be helpful to answer

DalJeanis
Legend

| join type=left means that the stuff coming into the left side (through the pipe symbol) will be matched and kept, whereas the stuff coming in from the subsearch on the right side will only be kept if it matches the left side. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join

The field _raw is the underlying data in its raw form. Per the documentation, it "contains the original raw data of an event." http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Usedefaultfields

One of the non-obvious results of the join will be that, if a record is found on the subsearch (right) side of the join, then (per default overwrite=true) the values for all fields found on the right branch will overwrite the values by the same names from the left branch. for any matching records.

0 Karma

woodcock
Esteemed Legend

It also means that your search is almost guaranteed to fail SILENTLY in the future as the joined dataset approaches the inescapable ~50K-event dataset size limit. Do not use join in Splunk for anything other than an ad-hoc search where you know your datasets are small. If you have a saved search using join, then you have created a time-bomb for somebody at some point.

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...