https://community.splunk.com/t5/Splunk-Search/join-3-queries/m-p/666627#M228676 <P>Hello<BR />I have 3 queries that i need to join between them but there is a catch&nbsp;</P><P>query number 1 checks for users who sent sms<BR />query number 2 checks if we tried to resend the sms</P><P>query number 3 check if we got verification that the sms sent<BR /><BR />in the end - i want to see only the cases where we have sent, resend and verify - all of them by id<BR />when im using simple join - i get all the results and not only those with the resend method&nbsp;</P> Sun, 29 Oct 2023 16:56:25 GMT sarit_s 2023-10-29T16:56:25Z https://community.splunk.com/t5/Splunk-Search/join-3-queries/m-p/666627#M228676 <P>Hello<BR />I have 3 queries that i need to join between them but there is a catch&nbsp;</P><P>query number 1 checks for users who sent sms<BR />query number 2 checks if we tried to resend the sms</P><P>query number 3 check if we got verification that the sms sent<BR /><BR />in the end - i want to see only the cases where we have sent, resend and verify - all of them by id<BR />when im using simple join - i get all the results and not only those with the resend method&nbsp;</P> Sun, 29 Oct 2023 16:56:25 GMT https://community.splunk.com/t5/Splunk-Search/join-3-queries/m-p/666627#M228676 sarit_s 2023-10-29T16:56:25Z https://community.splunk.com/t5/Splunk-Search/join-3-queries/m-p/666632#M228677 <P>It would help to know the specifics of each query.&nbsp; Without them, the best I can do is</P><LI-CODE lang="markup">&lt;&lt;query number 1&gt;&gt; | append [ &lt;&lt;query number 2&gt;&gt; ] | append [ &lt;&lt;query number 3&gt;&gt; ] | stats values(*) as * by id</LI-CODE> Sun, 29 Oct 2023 23:27:13 GMT https://community.splunk.com/t5/Splunk-Search/join-3-queries/m-p/666632#M228677 richgalloway 2023-10-29T23:27:13Z