Splunk Search

How can I join multiple source types with common field and search?


When I try to join three sourcetypes on CommonField, I don't get all the fields to populate in a table.


sourcetype1: CommonField, Field1, Field2, Field3
sourcetype2: CommonField, FieldX, Field Y, Field Z
sourcetype3: CommonFIeld, FieldA, FIeldB, Field C


source=data* | transaction CommonField keepevicted=true | table Field1, FieldX, FieldY, FieldA, FieldC

It does not populate all fields in the table. How can I join three sourcetypes on CommonField, and once joined, I can search as if each joined event has all those fields?

Thanks in advance!

0 Karma


Hi mattbrik,

very easy way to do such a search is using stats like this:

 ( index=a OR index=b OR index=c ) AND ( sourcetype=sourcetype1 OR sourcetype=sourcetype2 OR sourcetype=sourcetype3 )
 | stats values(*) AS * by CommonField 
 | do more SPL-Fu ....

You can read more about this topic here https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo...

Another free advice: forget about transaction, join and use stats you will not regret it 😉 . Also, if you need transactional events, just add _time to the by clause of the stats.

Hope this helps ...

cheers, MuS

0 Karma

index=index (sourcetype=sourcetype1 OR sourcetype=sourcetype2 OR sourcetype=sourcetype3)
 | join type=inner CommonField [ |inputcsv additional_data]
0 Karma