Actually I want to use join in that particularly since the number of rows is more than 10,000 I tried using "inline search" but it not giving complete result Actually I was looking for the id that is  present in that index ="ys_kb"  ... View more

lets imagine you have a field called fruit and it has 3 unique values apple,banana,mango you can do this: ... search for your fruit field ... | stats count by fruit you can also do this: ... search for your fruit field ... | stats count(eval(fruit="apple") as apples count(eval(fruit="banana")) as bananas count(eval(fruit="mango")) as mangos .... read here more: https://docs.splunk.com/Documentation/Splunk/7.3.1/Search/Usetheevalcommandandfunctions#Example_1:_Use_an_eval_expression_with_a_stats_function. note, there are other ways too ... View more