Splunk Search

How can I join multiple source types with common field and search?

mattbirk
Explorer

When I try to join three sourcetypes on CommonField, I don't get all the fields to populate in a table.

Example:

sourcetype1: CommonField, Field1, Field2, Field3
sourcetype2: CommonField, FieldX, Field Y, Field Z
sourcetype3: CommonFIeld, FieldA, FIeldB, Field C

Query:

source=data* | transaction CommonField keepevicted=true | table Field1, FieldX, FieldY, FieldA, FieldC

It does not populate all fields in the table. How can I join three sourcetypes on CommonField, and once joined, I can search as if each joined event has all those fields?

Thanks in advance!

0 Karma

MuS
Legend

Hi mattbrik,

very easy way to do such a search is using stats like this:

 ( index=a OR index=b OR index=c ) AND ( sourcetype=sourcetype1 OR sourcetype=sourcetype2 OR sourcetype=sourcetype3 )
 | stats values(*) AS * by CommonField 
 | do more SPL-Fu ....

You can read more about this topic here https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo...

Another free advice: forget about transaction, join and use stats you will not regret it 😉 . Also, if you need transactional events, just add _time to the by clause of the stats.

Hope this helps ...

cheers, MuS

0 Karma

pruthvikrishnap
Contributor
index=index (sourcetype=sourcetype1 OR sourcetype=sourcetype2 OR sourcetype=sourcetype3)
 | join type=inner CommonField [ |inputcsv additional_data]
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...