Solved: Query joining 3 sourcetypes - Splunk Community

Getting Data In

I am trying to create a query that combines results from 3 sources, one of which is a lookup table. Any help would be appreciated.

(sourcetype="sourcetypeA OR sourcetype="sourcetypeB" ) fieldinsourcetypeAndB=*   
| fields [all fields in A and B]
|stats values(*) as * by fieldinsourcetypeAndB
|appendcols [| inputlookup sourcetypeC.csv | fields fieldinA fieldinC]

1 Solution

Solution

Like this:

index="AandB" AND (sourcetype="sourcetypeA OR sourcetype="sourcetypeB") AND fieldinsourcetypeAndB="*"
| fields [only fields that we care about in A and B]
| stats values(*) AS * BY fieldinsourcetypeAndB
| lookup sourcetypeC.csv fieldinC AS fieldinA

View solution in original post

Solution

Like this:

index="AandB" AND (sourcetype="sourcetypeA OR sourcetype="sourcetypeB") AND fieldinsourcetypeAndB="*"
| fields [only fields that we care about in A and B]
| stats values(*) AS * BY fieldinsourcetypeAndB
| lookup sourcetypeC.csv fieldinC AS fieldinA

Get Updates on the Splunk Community!

Agentic Operations Start with Context: Build the Right Data Foundation

Agentic Operations Start with Context: Build the Right Data Foundation By Courtney Wright, Product Marketing ...

Assisted, Augmented or Agentic? Choose Your Splunk Starting Point

Assisted, Augmented or Agentic? Choose Your Splunk Starting Point By Courtney Wright, Product Marketing ...

Session 2 | Beyond the Thread: Operationalizing AI with Confidence

Session 2 Beyond the Thread: Operationalizing AI with Confidence The true power of the Cisco Data Fabric ...