Inside Sideview

Come See Nick Talk at conf19 – “Master Joining Without Using Join”

October 10th, 2019

If you’re coming to the Splunk user conference in Vegas, aka conf19, come see my talk – Master Joining Your Datasets Without Using Join”! It’s on Thursday 1024 10:30am.

If you use Splunk and you have any searches or reports that use the join, append, or transaction commands this is a talk for you. Likewise if you have long-running” searches or reports, or heck if you run any searches with more than a few commands in them, you should come.

Because this is such a core thing in Splunk it’s the opposite of new and shiny but it’s still just as important as ever and it’s still a place in Splunk where it’s surprisingly easy to shoot yourself in the foot. I’ll essentially show how Splunk implements its distributed reporting and how the search language pushes the bulk of the reporting work out to the indexer nodes. I’ll also show how easy it is to go down the wrong roads, like using join and append when you shouldn’t, and how to troubleshoot and fix things when you do.

I hope to see you there!

ALSO on a higher level, if you’ve been wishing there was more technical content at .conf, this is one of just 5 special talks that have been selected by the Splunk Community, that is kind of a new thing at conf this year. So if you’ve been wishing for more technical content — vote with your feet! register for these talks, come to them, and if you like them we’ll keep this ball rolling and get even more technical content into the conference next year!

Last but not least, while I’m plugging excellent technical things at conf, I can’t resist also plugging Martin Müller’s talk as well about fields and indexed tokens.

Related

Inside Sideview

April 10th, 2018

Download a 90-day free trial & work with your own live data

Start My Free Trial

*indicates required field

By submitting this form, I agree to Sideview's Trial Internal Use License Agreement and Privacy Policy.