[|tstats latest(source) as source where source="F:\\FTPROOT\\Splunk Inputs\\IDM_*.csv" | fields source] returns 245,546 events [|tstats latest(source) as source where source="F:\\FTPROOT\\Splunk Inputs\\IDM_*.csv" | fields source] | eval manager="uid="+uid+",ou=users,dc=cardinalhealth,dc=com" | rename employeeType AS managerEmpType | fields manager | table uid managerEmpType returns 245,546 events But when I join them thusly: [|tstats latest(source) as source where source="F:\\FTPROOT\\Splunk Inputs\\IDM_*.csv" | fields source | join manager [search [|tstats latest(source) as source where source="F:\\FTPROOT\\Splunk Inputs\\IDM_*.csv" | fields source] | eval manager="uid="+uid+",ou=users,dc=cardinalhealth,dc=com" | rename employeeType AS managerEmpType | fields manager managerEmpType] table uid managerEmpType I only get 43,440 matches. In theory, the subsearch should return a match for every event in the primary. Am I missing something obvious here? ... View more