topic How can I join three fields with a common ID field? in Splunk Search

How can I join three fields with a common ID field?

sravankaripe — Wed, 16 Aug 2017 18:20:18 GMT

Hi,

i want to join all three fields with common id field. please help me with search query

| table id servicename errordetails

i have data like this
Ex:
In index = abc "error"
servicename id

abc 101
gfg 102
hhv 105

and In index = abc "errordetails"
id errordetails

103 error1
102 error5
104 errorabc
105 error4545

i want to join both by field "id". so i want data like this

id servicename errordetails

102 gfg error5
105 hhy error4545

Please help me with this

Re: How can I join three fields with a common ID field?

cmerriman — Wed, 16 Aug 2017 18:26:00 GMT

try something like this to avoid using join, as there are limits.

(index = abc "errordetails") OR (index = abc "error")
|stats values(servicename) as servicename values(errordetails) as errordetails by id
|where isnotnull(servicename) AND isnotnull(errordetails)

the where statement should ensure you're only grabbing ids that include both errordetails and servicename, without it, it's like an outer join.