topic Re: Different sourcetypes in a single search in Getting Data In

Different sourcetypes in a single search

vaishnavi07 — Thu, 14 May 2015 06:04:38 GMT

Hi,

I have to search for data from two different sourcetypes. There is a common field in both the sourcetypes called id. So When i search using this id it should return the corresponding events from both the sourcetypes. It sould searchin both and return the events if the id exists. Can anyone suggest how to do this? Thanks in advance.

Re: Different sourcetypes in a single search

MuS — Thu, 14 May 2015 06:15:29 GMT

Hi vaishnavi07,

For sure I can suggest how to do this; take a look at this answer here : http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html

It will explain everything to you....

cheers, MuS

Re: Different sourcetypes in a single search

mikebd — Tue, 19 May 2015 13:26:47 GMT

(sourcetype=st_1 OR sourcetype=st_2) id=id_to_search_for