I am just curious to know what does it actually doing in a big splunk quary?
As per the result i understood if we use join it joins the query.
| join type=left
means that the stuff coming into the left side (through the pipe symbol) will be matched and kept, whereas the stuff coming in from the subsearch on the right side will only be kept if it matches the left side. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join
The field _raw
is the underlying data in its raw form. Per the documentation, it "contains the original raw data of an event." http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Usedefaultfields
One of the non-obvious results of the join will be that, if a record is found on the subsearch (right) side of the join, then (per default overwrite=true) the values for all fields found on the right branch will overwrite the values by the same names from the left branch. for any matching records.
it depends on your dataset. If the dataset is huge, i wouldn't use join
but two searches with a NOT. if you give example of your dataset, it will be helpful to answer
| join type=left
means that the stuff coming into the left side (through the pipe symbol) will be matched and kept, whereas the stuff coming in from the subsearch on the right side will only be kept if it matches the left side. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join
The field _raw
is the underlying data in its raw form. Per the documentation, it "contains the original raw data of an event." http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Usedefaultfields
One of the non-obvious results of the join will be that, if a record is found on the subsearch (right) side of the join, then (per default overwrite=true) the values for all fields found on the right branch will overwrite the values by the same names from the left branch. for any matching records.
It also means that your search is almost guaranteed to fail SILENTLY in the future as the joined dataset approaches the inescapable ~50K-event dataset size limit. Do not use join
in Splunk for anything other than an ad-hoc search where you know your datasets are small. If you have a saved search
using join
, then you have created a time-bomb for somebody at some point.