To use the join command, the field name must be the same in both searches and it must correlate to two data sets. To minimize the resource consumption within Splunk, the join command is primarily used when the results of the subsearch are relatively small — 50,000 rows or fewer.