Splunk Search

How can I join multiple source types with common field and search?


When I try to join three sourcetypes on CommonField, I don't get all the fields to populate in a table.


sourcetype1: CommonField, Field1, Field2, Field3
sourcetype2: CommonField, FieldX, Field Y, Field Z
sourcetype3: CommonFIeld, FieldA, FIeldB, Field C


source=data* | transaction CommonField keepevicted=true | table Field1, FieldX, FieldY, FieldA, FieldC

It does not populate all fields in the table. How can I join three sourcetypes on CommonField, and once joined, I can search as if each joined event has all those fields?

Thanks in advance!

0 Karma


Hi mattbrik,

very easy way to do such a search is using stats like this:

 ( index=a OR index=b OR index=c ) AND ( sourcetype=sourcetype1 OR sourcetype=sourcetype2 OR sourcetype=sourcetype3 )
 | stats values(*) AS * by CommonField 
 | do more SPL-Fu ....

You can read more about this topic here https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo...

Another free advice: forget about transaction, join and use stats you will not regret it 😉 . Also, if you need transactional events, just add _time to the by clause of the stats.

Hope this helps ...

cheers, MuS

0 Karma

index=index (sourcetype=sourcetype1 OR sourcetype=sourcetype2 OR sourcetype=sourcetype3)
 | join type=inner CommonField [ |inputcsv additional_data]
0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...