https://community.splunk.com/t5/Getting-Data-In/Query-joining-3-sourcetypes/m-p/498566#M84969 <P>Like this:</P> <PRE><CODE>index="AandB" AND (sourcetype="sourcetypeA OR sourcetype="sourcetypeB") AND fieldinsourcetypeAndB="*" | fields [only fields that we care about in A and B] | stats values(*) AS * BY fieldinsourcetypeAndB | lookup sourcetypeC.csv fieldinC AS fieldinA </CODE></PRE> Wed, 27 Nov 2019 21:35:40 GMT woodcock 2019-11-27T21:35:40Z https://community.splunk.com/t5/Getting-Data-In/Query-joining-3-sourcetypes/m-p/498565#M84968 <P>I am trying to create a query that combines results from 3 sources, one of which is a lookup table. Any help would be appreciated.</P> <PRE><CODE>(sourcetype="sourcetypeA OR sourcetype="sourcetypeB" ) fieldinsourcetypeAndB=* | fields [all fields in A and B] |stats values(*) as * by fieldinsourcetypeAndB |appendcols [| inputlookup sourcetypeC.csv | fields fieldinA fieldinC] </CODE></PRE> Wed, 27 Nov 2019 20:54:39 GMT https://community.splunk.com/t5/Getting-Data-In/Query-joining-3-sourcetypes/m-p/498565#M84968 markhvesta 2019-11-27T20:54:39Z https://community.splunk.com/t5/Getting-Data-In/Query-joining-3-sourcetypes/m-p/498566#M84969 <P>Like this:</P> <PRE><CODE>index="AandB" AND (sourcetype="sourcetypeA OR sourcetype="sourcetypeB") AND fieldinsourcetypeAndB="*" | fields [only fields that we care about in A and B] | stats values(*) AS * BY fieldinsourcetypeAndB | lookup sourcetypeC.csv fieldinC AS fieldinA </CODE></PRE> Wed, 27 Nov 2019 21:35:40 GMT https://community.splunk.com/t5/Getting-Data-In/Query-joining-3-sourcetypes/m-p/498566#M84969 woodcock 2019-11-27T21:35:40Z