Getting Data In

How to correlate data between two different sourcetypes when one is in JSON format?

dwong2
New Member

I have one index and two sourcetypes. I want to be able to count the actions from sourcetypeA and correlate the data from sourcetypeB. SourcetypeB however is in JSON format.

**sourcetypeA:**
  accountId: 12345678       
       **action:** Enter        
       assetId: 7a8b9c      
       dateTime: 2018-04-21T20:32:52.295348Z        
       deviceID: abcdefgh       
       **publishId:** 63600U        
       **tile:** Tile1          

**sourcetypeB:**             
    dateTime: 2018-04-21T19:44:41.3524516Z      
       **publishId**: 63600U        
       published: { [-] 
         Background: {  [+] 
         }      
         Condition: {   [+] 
         }      
         EditBy: charlie        
         EditTime: 2018-04-15T19:43:58.1671071Z     
         Id: 6      
         Info: {    [+] 
         }      
         PublishBy: charlie     
         PublishTime: 2018-04-15T19:44:41.3524516Z      
         ScheduleTime: 2018-04-15T19:50:00Z     
         Template: {    [+] 
         }      
         Tiles: [   [-] 
           {    [+] 
           }    
           {    [+] 
           }    
           {    [-] 
             Condition: {   [+] 
             }      
             Id: 2      
             **Name:** Tile1        
             **Subscribed:** {  [-] 
               Images: [    [+] 
               ]        
               Live: {  [+] 
               }        
               Text: [  [-] 
                 Tile1Text  

               ]        
               **TileTypeIndicator**: category      
               }        
             **Unsubscribed**: {    [-] 
               Images: [    [+]

I'm trying to join (don't know if that is the right word used in SPL?) on "publishId" between the two sourcetypes.
Then count the number of "tiles" from sourcetypeA while referencing the related information from sourcetypeB?
i.e. Tile1 is Tile1Text, Tile2 is Tile2Text, Tile3 is Tile3Text, etc.

sourceytypeA has the data for how many times "tile" is logged. i.e. Tile1
sourcetypeB has the information of what Tile1 is referenced to. i.e. Tile1Text
Then sort between subscribed and unsubscribed.

| rename published.Tiles{}.Name AS Name, published.Tiles{}.Subscribed.Text{} as Text

0 Karma

David_Naylor
Path Finder

This probably isn't the answer, but hopefully you can run with it.

Something along the lines of..

sourcetype=sourcetypeA
| stats values(*) as * by publishId
| join publishId type=left
[| search sourcetypeB
| spath
| (Do the field manipulation/extraction you want here, might have to use rex, eval, foreach or a combination of the 3)
| table fieldyoucareabout, publishId

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...