Splunk Search

Combine 3 different source type in single table

ND
Path Finder

Hi,

I want to combine 3 different source type in single table. The column names are different in all the 3 source type to join them.

Eg.

Source type = a

ID name location

Source type = b

PID country 

Source type = c

id contact_number

 

Kindly help to get output as follows:

PID name location country contact_number

There are more than 50 column I want in table.

 

Thank & Regards

 

Labels (2)
0 Karma

Richfez
SplunkTrust
SplunkTrust

if PID is equal to ID (I hope it is, or else you either didn't give us enough information to solve the problem, or the problem is unsolveable because they're not actually related records... 🙂 )

(sourcetype=a AND index=foo) OR (sourcetype=b AND index=bar) OR (sourcetype=c)
| eval master_id = case(sourcetype=a, ID, sourcetype=b, PID, sourcetype=c, id)
| stats values(*) as * by master_id

You can use, like I did, an eval/case statement to collapse all possible field names that are your ID into one field you can stats on.

Or you could use the coalesce function.

Or a couple of eval/if statements.

And the `stats values(*) as * by ...` is really just shortcut to "doing all the fields". You could replace it with values(field1) as newnameforField1, values(field2) as ...

Or list(field1) as newnameforField1, ...

or any other pile of possibilities.

Anyway.

The idea is just pile them all together, create a new ID that is the same field name for all, then let stats "group" then by that new id field.

 

happy splunking!

-Rich

Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...