Solved: Query joining 3 sourcetypes - Splunk Community

Getting Data In

I am trying to create a query that combines results from 3 sources, one of which is a lookup table. Any help would be appreciated.

(sourcetype="sourcetypeA OR sourcetype="sourcetypeB" ) fieldinsourcetypeAndB=*   
| fields [all fields in A and B]
|stats values(*) as * by fieldinsourcetypeAndB
|appendcols [| inputlookup sourcetypeC.csv | fields fieldinA fieldinC]

1 Solution

Solution

Like this:

index="AandB" AND (sourcetype="sourcetypeA OR sourcetype="sourcetypeB") AND fieldinsourcetypeAndB="*"
| fields [only fields that we care about in A and B]
| stats values(*) AS * BY fieldinsourcetypeAndB
| lookup sourcetypeC.csv fieldinC AS fieldinA

View solution in original post

Solution

Like this:

index="AandB" AND (sourcetype="sourcetypeA OR sourcetype="sourcetypeB") AND fieldinsourcetypeAndB="*"
| fields [only fields that we care about in A and B]
| stats values(*) AS * BY fieldinsourcetypeAndB
| lookup sourcetypeC.csv fieldinC AS fieldinA

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...