topic How to do simple join between two different source types like primary key & foreign key in SQL? in Splunk Search

How to do simple join between two different source types like primary key & foreign key in SQL?

tskarthic — Fri, 25 Aug 2017 18:14:29 GMT

I have two different source types Source A & B. 'ID' is the common field in both sources.
For each 'ID' in source A, multiple records will be in source B.
i want to fetch all the records from source A and latest matching record by compare the timestamp field value of source B.
How to make join like primary key and foreign key join in SQL.

Re: How to do simple join between two different source types like primary key & foreign key in SQL?

DalJeanis — Fri, 25 Aug 2017 19:04:22 GMT

First, go read this one. Thinking about SQL's way of doing things will just mess you up over here.

https://answers.splunk.com/answers/561130/sql-analogy-for-my-log-search-join-two-tables-wher.html

Second, here's another reference answer for how to combine one record with the latest matching record

https://answers.splunk.com/answers/561578/map-fields-from-two-sourcetypes-based-on-a-certain.html