https://community.splunk.com/t5/Splunk-Search/How-to-join-2-different-source-tyoe-using-identity-column/m-p/112221#M29471 <P>Hi All,</P> <P>We have 2 different sourcetype master and child need to join/append the source type on identity column master.id and child.mastertable_id. Please let us how can we display the result in search query using table format. </P> <P>sourcetype=master :<BR /> id(pk)|filename|status<BR /> 123|test1.txt|S<BR /> 124|test2.txt|F<BR /> 125|test3.txt|S<BR /> 126|test4.txt|F</P> <P>sourcetype=child :<BR /> id|mastertable_id(FK)|msg<BR /> 221|124|connectivity issue<BR /> 223|126|user aborted</P> <P>Final result should look like:<BR /> id|filename|status|childid|msg<BR /> 123|test1.txt|S|NA|NA<BR /> 124|test2.txt|F|221|connectivity issue<BR /> 125|test3.txt|S|NA|NA<BR /> 126|test4.txt|F|223|126|user aborted</P> <P>Thanks</P> Fri, 10 Jul 2015 03:19:18 GMT muguniya 2015-07-10T03:19:18Z https://community.splunk.com/t5/Splunk-Search/How-to-join-2-different-source-tyoe-using-identity-column/m-p/112221#M29471 <P>Hi All,</P> <P>We have 2 different sourcetype master and child need to join/append the source type on identity column master.id and child.mastertable_id. Please let us how can we display the result in search query using table format. </P> <P>sourcetype=master :<BR /> id(pk)|filename|status<BR /> 123|test1.txt|S<BR /> 124|test2.txt|F<BR /> 125|test3.txt|S<BR /> 126|test4.txt|F</P> <P>sourcetype=child :<BR /> id|mastertable_id(FK)|msg<BR /> 221|124|connectivity issue<BR /> 223|126|user aborted</P> <P>Final result should look like:<BR /> id|filename|status|childid|msg<BR /> 123|test1.txt|S|NA|NA<BR /> 124|test2.txt|F|221|connectivity issue<BR /> 125|test3.txt|S|NA|NA<BR /> 126|test4.txt|F|223|126|user aborted</P> <P>Thanks</P> Fri, 10 Jul 2015 03:19:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-2-different-source-tyoe-using-identity-column/m-p/112221#M29471 muguniya 2015-07-10T03:19:18Z https://community.splunk.com/t5/Splunk-Search/How-to-join-2-different-source-tyoe-using-identity-column/m-p/112222#M29472 <P>What with this?</P> <P>(your search)|rename id as childid|rename mastertable_id(FK) as id|rename id(pk) as id|stats max(filename) as filename,max(status) as status,max(childid) as childid,max(msg) as msg by id</P> Fri, 10 Jul 2015 05:48:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-2-different-source-tyoe-using-identity-column/m-p/112222#M29472 HiroshiSatoh 2015-07-10T05:48:07Z