Splunk join

search A | join user [search B]

Correlates two Splunk searches by a common field with join, joining events from different sources to reconstruct the attack chain.

Run it when you need to join events from two sources that a common field connects: the classic example is joining logons (4624) with processes created by that user, or EDR alerts with SIEM events — the join by user gives you the view 'this user logged in and then executed this'. It's Splunk's explicit correlation tool: when the relationship between events can't be expressed with stats or transaction, join merges the two searches by the field. In an IR, join reconstructs the sequence: who, from where, and what they executed afterward.

Don't use it in large searches without thinking: join is one of Splunk's most expensive operations (both sides are materialized in memory) and at high volumes it blows up or takes forever — for aggregations, stats with multivalue fields, or transaction are usually more efficient. The default join is inner (only matches on both sides): if one side lacks the field, events are silently lost. And watch out for duplicate fields: if both sides bring fields with the same name, you must rename them beforehand or the result mixes values. For volume correlations (all alerts for a user), lookup or subsearches are lighter alternatives.