Can I do multiple joins with different fields

[stavbergen]

Hello I have 3 sets of data and I want to join them all but they don't have the same common field, the trouble I'm having is linking table 2 to table 3.

Table 1
host, ip

Table 2
host, ip, user

Table 3
 user, location

[richgalloway · Accepted solution]

Yes, joins can be nested.

index=foo host=* ip=*
| join host, ip [ index=bar host=* ip=* user=*
  | join user [ index=baz user=* location=* ]
  ]
]