https://community.splunk.com/t5/Splunk-Search/Can-I-do-multiple-joins-with-different-fields/m-p/567170#M197642 <P>Hello I have 3 sets of data and I want to join them all but they don't have the same common field, the trouble I'm having is linking table 2 to table 3.<BR /><BR />Table 1<BR />host, ip<BR /><BR />Table 2<BR />host, ip, user<BR /><BR />Table 3<BR />&nbsp;user, location<BR /><BR /><BR /></P> Thu, 16 Sep 2021 00:18:36 GMT stavbergen 2021-09-16T00:18:36Z https://community.splunk.com/t5/Splunk-Search/Can-I-do-multiple-joins-with-different-fields/m-p/567170#M197642 <P>Hello I have 3 sets of data and I want to join them all but they don't have the same common field, the trouble I'm having is linking table 2 to table 3.<BR /><BR />Table 1<BR />host, ip<BR /><BR />Table 2<BR />host, ip, user<BR /><BR />Table 3<BR />&nbsp;user, location<BR /><BR /><BR /></P> Thu, 16 Sep 2021 00:18:36 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-do-multiple-joins-with-different-fields/m-p/567170#M197642 stavbergen 2021-09-16T00:18:36Z https://community.splunk.com/t5/Splunk-Search/Can-I-do-multiple-joins-with-different-fields/m-p/567249#M197667 <P>Yes, joins can be nested.</P><LI-CODE lang="markup">index=foo host=* ip=* | join host, ip [ index=bar host=* ip=* user=* | join user [ index=baz user=* location=* ] ] ]</LI-CODE> Thu, 16 Sep 2021 12:06:52 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-do-multiple-joins-with-different-fields/m-p/567249#M197667 richgalloway 2021-09-16T12:06:52Z