Splunk Search

Correlation between 3 sources with 2 IDs

jsp
Engager

I have 3 sourcetypes, and am trying to correlate them based off of 2 IDs. Here is an oversimplified example of the data and what I am trying to achive:

index=books sourcetype=titles
fields: title   title_id    queue_id

index=books sourcetype=authors
fields: author  title_id

index=books sourcetype=locations
fields: location    queue_id

What is the easiest way to get title, author, location, title_id, queue_id in one row of results, based on a search for a title?

Tags (2)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

index=books sourcetype=titles title=TITLE | join type=outer title_id [search index=books sourcetype=authors ]|join type=outer queue_id [search index=books sourcetype=locations]| stats count by title author location title_id queue_id

Should get you started. join's are a little ineffective, but if you make them static lookups, they would run faster.

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...