https://community.splunk.com/t5/Getting-Data-In/Combining-different-sourcetypes-with-no-common-field-except-time/m-p/558455#M92392 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/227098">@ISP8055</a>&nbsp;</P><P>Can you please try this?</P><LI-CODE lang="markup">index=your_index (sourcetype="sourcetypeA" OR sourcetype="sourcetypeB") | eval Cluster=if(isnotnull(Cluster1),Cluster1,Cluster2) | eval Usage=if(isnotnull(UsageA),UsageA,UsageB) | fields Cluster Usage | sort - Usage | head 3</LI-CODE><P>&nbsp;</P><P><STRONG>My Sample Search :</STRONG></P><LI-CODE lang="markup">| makeresults | eval _raw="Cluster1 UsageA A 10 B 15" | multikv forceheader=1 | append [ | makeresults | eval _raw="Cluster2 UsageB C 5 D 20" | multikv forceheader=1 ] | eval Cluster=if(isnotnull(Cluster1),Cluster1,Cluster2) | eval Usage=if(isnotnull(UsageA),UsageA,UsageB) | fields Cluster Usage | sort - Usage | head 3</LI-CODE><P>&nbsp;</P><P>Thanks<BR />KV<BR />▄︻̷̿┻̿═━一<BR /><BR />If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.</P> Tue, 06 Jul 2021 16:51:46 GMT kamlesh_vaghela 2021-07-06T16:51:46Z https://community.splunk.com/t5/Getting-Data-In/Combining-different-sourcetypes-with-no-common-field-except-time/m-p/558450#M92390 <P>Hi, I have one sourcetypeA which has following fields<BR /><BR /></P><TABLE border="1" width="44.44409473172445%"><TBODY><TR><TD width="33.333333333333336%">Cluster1</TD><TD width="33.333333333333336%">UsageA</TD></TR><TR><TD width="33.333333333333336%">A</TD><TD width="33.333333333333336%">10</TD></TR><TR><TD width="33.333333333333336%">B</TD><TD width="33.333333333333336%">15</TD></TR></TBODY></TABLE><P>and so on</P><P>then I have one sourcetypeB which has fields:</P><TABLE border="1" width="100%"><TBODY><TR><TD width="50%">Cluster 2</TD><TD width="50%">Usage B</TD></TR><TR><TD width="50%">C</TD><TD width="50%">5</TD></TR><TR><TD>D</TD><TD>20</TD></TR></TBODY></TABLE><P><BR />I want to make a Splunk syntax so that I combine both sourcetypes to see top 3 usage in total among all clusters.<BR />so like this:</P><TABLE border="1" width="100%"><TBODY><TR><TD width="50%">Cluster</TD><TD width="50%">Usage</TD></TR><TR><TD width="50%">D</TD><TD width="50%">20</TD></TR><TR><TD width="50%">B</TD><TD width="50%">15</TD></TR><TR><TD width="50%">A</TD><TD width="50%">10</TD></TR></TBODY></TABLE><P><BR /><BR />So, neither Cluster 2, cluster 1 nor usage A&nbsp; and Usage B are common fields.<BR />Is this possible to do?</P> Tue, 06 Jul 2021 16:39:39 GMT https://community.splunk.com/t5/Getting-Data-In/Combining-different-sourcetypes-with-no-common-field-except-time/m-p/558450#M92390 ISP8055 2021-07-06T16:39:39Z https://community.splunk.com/t5/Getting-Data-In/Combining-different-sourcetypes-with-no-common-field-except-time/m-p/558455#M92392 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/227098">@ISP8055</a>&nbsp;</P><P>Can you please try this?</P><LI-CODE lang="markup">index=your_index (sourcetype="sourcetypeA" OR sourcetype="sourcetypeB") | eval Cluster=if(isnotnull(Cluster1),Cluster1,Cluster2) | eval Usage=if(isnotnull(UsageA),UsageA,UsageB) | fields Cluster Usage | sort - Usage | head 3</LI-CODE><P>&nbsp;</P><P><STRONG>My Sample Search :</STRONG></P><LI-CODE lang="markup">| makeresults | eval _raw="Cluster1 UsageA A 10 B 15" | multikv forceheader=1 | append [ | makeresults | eval _raw="Cluster2 UsageB C 5 D 20" | multikv forceheader=1 ] | eval Cluster=if(isnotnull(Cluster1),Cluster1,Cluster2) | eval Usage=if(isnotnull(UsageA),UsageA,UsageB) | fields Cluster Usage | sort - Usage | head 3</LI-CODE><P>&nbsp;</P><P>Thanks<BR />KV<BR />▄︻̷̿┻̿═━一<BR /><BR />If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.</P> Tue, 06 Jul 2021 16:51:46 GMT https://community.splunk.com/t5/Getting-Data-In/Combining-different-sourcetypes-with-no-common-field-except-time/m-p/558455#M92392 kamlesh_vaghela 2021-07-06T16:51:46Z