Getting Data In

Join three sources without common fields and assign one fields to other field

Mounika1025
New Member

I have three sources on same index ="test"

source1 source2 RefSource2

Trans_ID SourceType TRANS_ID Trans_Name Trans_Type REF_ID REF_DESC
123 01 123 Name1 03 01 Type1
234 02 345 Name4 04 02 Type2
345 03 567 Name2 02 03 Type3
04 Type4

Result table should be

Trans_ID SourceType Trans_Name Trans_Type
123 Type1 Name1 Type3

345 Type3 Name4 Type4 where Trans_id is common for source1and source2..

Please help me how to achive above result

Tags (1)
0 Karma

Mounika1025
New Member
Attached image ralted to tables and its relation .                      
Source 1 &source2 has common filed Trans_ID                     
IF Source1.SourceType=REF_ID then assign Source1.SourceType=REF_DESC                        
IF Source2.Trans_Type=REF_ID then assign Source2.Trans_Type=REF_DESC                        

                        ![alt text][1]
Final Result should be:                     

Trans_ID     SourceType Trans_Name  Trans_Type          
123 Type1   Name1   Type4           
345 Type3   Name3   Type2           
0 Karma

somesoni2
Revered Legend

Can you post which source have what fields and (if any) relationship between those fields?

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...