How can we join two sourcetypes together that have a common field?

[Hema_Nithya]

How can we join fields of two source types, when one field is the same in both source types?

[cmerriman]

try this.

index=itsm sourcetype=tsm_filespaces OR sourcetype=tsm_nodes|stats values(*) as * by node_name| dedup node_name,filespace_name | table node_name, platform_name, filespace_name,backup_end,host

[Hema_Nithya]

yes , I used Join ...

index=itsm sourcetype=tsm_filespaces |join node_name [search sourcetype=tsm_nodes] | dedup node_name,filespace_name | table node_name, platform_name, filespace_name,backup_end,host

[somesoni2]

Do node_name and filespace_name fields available in same sourcetype (single) OR both sourcetypes?

[niketn]

There could be multiple ways

Easiest to do might be through transaction

sourcetype="srcType1" OR sourcetype="srcType2" commonField=*
| transaction commonField
| table _time, eventcount, duration, _raw

However, stats might perform better based on use case. You will have to use combinations of first(), last(), min(), max() or values() etc for various fields that you want to work on after correlation

sourcetype="srcType1" OR sourcetype="srcType2" commonField=*
| stats count as eventcount by commonField
| search eventcount>1

You can also use append, appendcols, appendpipe, join,lookup etc based on your needs.

Refer to the following event correlation documentation for deciding on your choice: http://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation

[niketn]

As per your example

index=itsm sourcetype=tsm_filespaces  OR sourcetype=tsm_nodes node_name=* 
|stats values(filespacename) as filespacename values(platform_name) as platform_name values(backup_end) as backup_end values(host) as host by nodename 

[somesoni2]

There are various methods for it and which one will be best depends upon the output that you expect after joining them. Could you explain more on what is your end goal after joining those two sourcetype's data?

[renjith_nair]

Are you looking for something like

(sourcetype=A OR sourcetype=B) commonfield=<value>

OR

(sourcetype=A OR sourcetype=B) |stats values(commonfield)

[cmerriman]

I want to make sure I understand.

You have Sourcetype A and Sourcetype B and both of them have Field X and you want to join these two sourcetypes together based on Field X?