Note that using join in Splunk is often not the best/right solution. Yes it can work, but when it does not, you will not know that it has not joined all the data. It uses subsearches, which have limitations that can affect the join. Notably the join can not return more than 50,000 results or take longer than 60 seconds by default. In case it does, you will not get all the results from the subsearch. @ITWhisperer example show how you typically do joins in Splunk using stats, which does not have those limitations.   ... View more

@inventsekar Rather than stats by count, i had to fix regular expression to take a escape character. It helped me fix. Thanks for responding and helping with great insights. ... View more

Thank you for sharing the docs. They helped a lot. ... View more