When I try to join three sourcetypes on CommonField, I don't get all the fields to populate in a table.
Example:
sourcetype1: CommonField, Field1, Field2, Field3
sourcetype2: CommonField, FieldX, Field Y, Field Z
sourcetype3: CommonFIeld, FieldA, FIeldB, Field C
Query:
source=data* | transaction CommonField keepevicted=true | table Field1, FieldX, FieldY, FieldA, FieldC
It does not populate all fields in the table. How can I join three sourcetypes on CommonField, and once joined, I can search as if each joined event has all those fields?
Thanks in advance!
Hi mattbrik,
very easy way to do such a search is using stats
like this:
( index=a OR index=b OR index=c ) AND ( sourcetype=sourcetype1 OR sourcetype=sourcetype2 OR sourcetype=sourcetype3 )
| stats values(*) AS * by CommonField
| do more SPL-Fu ....
You can read more about this topic here https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo...
Another free advice: forget about transaction
, join
and use stats
you will not regret it 😉 . Also, if you need transactional events, just add _time
to the by
clause of the stats
.
Hope this helps ...
cheers, MuS
index=index (sourcetype=sourcetype1 OR sourcetype=sourcetype2 OR sourcetype=sourcetype3)
| join type=inner CommonField [ |inputcsv additional_data]