How can I join multiple source types with common field and search?

[mattbirk]

When I try to join three sourcetypes on CommonField, I don't get all the fields to populate in a table.

Example:

sourcetype1: CommonField, Field1, Field2, Field3
sourcetype2: CommonField, FieldX, Field Y, Field Z
sourcetype3: CommonFIeld, FieldA, FIeldB, Field C

Query:

source=data* | transaction CommonField keepevicted=true | table Field1, FieldX, FieldY, FieldA, FieldC

It does not populate all fields in the table. How can I join three sourcetypes on CommonField, and once joined, I can search as if each joined event has all those fields?

Thanks in advance!

[MuS]

Hi mattbrik,

very easy way to do such a search is using stats like this:

 ( index=a OR index=b OR index=c ) AND ( sourcetype=sourcetype1 OR sourcetype=sourcetype2 OR sourcetype=sourcetype3 )
 | stats values(*) AS * by CommonField 
 | do more SPL-Fu ....

You can read more about this topic here https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo...

Another free advice: forget about transaction, join and use stats you will not regret it 😉 . Also, if you need transactional events, just add _time to the by clause of the stats.

Hope this helps ...

cheers, MuS

[pruthvikrishnap]

index=index (sourcetype=sourcetype1 OR sourcetype=sourcetype2 OR sourcetype=sourcetype3)
 | join type=inner CommonField [ |inputcsv additional_data]