Splunk Search

How can I join three fields with a common ID field?

Path Finder

alt text


i want to join all three fields with common id field. please help me with search query

| table id servicename errordetails

i have data like this
In index = abc "error"
servicename id

abc 101
gfg 102
hhv 105

and In index = abc "errordetails"
id errordetails

103 error1
102 error5
104 errorabc
105 error4545

i want to join both by field "id". so i want data like this

id servicename errordetails

102 gfg error5
105 hhy error4545

Please help me with this

0 Karma

Re: How can I join three fields with a common ID field?

Super Champion

try something like this to avoid using join, as there are limits.

(index = abc "errordetails") OR (index = abc "error")
|stats values(servicename) as servicename values(errordetails) as errordetails by id
|where isnotnull(servicename) AND isnotnull(errordetails)

the where statement should ensure you're only grabbing ids that include both errordetails and servicename, without it, it's like an outer join.

View solution in original post

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.