Query joining 3 sourcetypes

[markhvesta]

I am trying to create a query that combines results from 3 sources, one of which is a lookup table. Any help would be appreciated.

(sourcetype="sourcetypeA OR sourcetype="sourcetypeB" ) fieldinsourcetypeAndB=*   
| fields [all fields in A and B]
|stats values(*) as * by fieldinsourcetypeAndB
|appendcols [| inputlookup sourcetypeC.csv | fields fieldinA fieldinC]

[woodcock · Accepted solution]

Like this:

index="AandB" AND (sourcetype="sourcetypeA OR sourcetype="sourcetypeB") AND fieldinsourcetypeAndB="*"
| fields [only fields that we care about in A and B]
| stats values(*) AS * BY fieldinsourcetypeAndB
| lookup sourcetypeC.csv fieldinC AS fieldinA