Splunk Search
Highlighted

How can we join two sourcetypes together that have a common field?

Explorer

How can we join fields of two source types, when one field is the same in both source types?

0 Karma
Highlighted

Re: How can we join two sourcetypes together that have a common field?

Super Champion

I want to make sure I understand.

You have Sourcetype A and Sourcetype B and both of them have Field X and you want to join these two sourcetypes together based on Field X?

0 Karma
Highlighted

Re: How can we join two sourcetypes together that have a common field?

SplunkTrust
SplunkTrust

Are you looking for something like

(sourcetype=A OR sourcetype=B) commonfield=<value>

OR

(sourcetype=A OR sourcetype=B) |stats values(commonfield)
0 Karma
Highlighted

Re: How can we join two sourcetypes together that have a common field?

SplunkTrust
SplunkTrust

There are various methods for it and which one will be best depends upon the output that you expect after joining them. Could you explain more on what is your end goal after joining those two sourcetype's data?

0 Karma
Highlighted

Re: How can we join two sourcetypes together that have a common field?

Legend

There could be multiple ways

Easiest to do might be through transaction

sourcetype="srcType1" OR sourcetype="srcType2" commonField=*
| transaction commonField
| table _time, eventcount, duration, _raw

However, stats might perform better based on use case. You will have to use combinations of first(), last(), min(), max() or values() etc for various fields that you want to work on after correlation

sourcetype="srcType1" OR sourcetype="srcType2" commonField=*
| stats count as eventcount by commonField
| search eventcount>1

You can also use append, appendcols, appendpipe, join,lookup etc based on your needs.

Refer to the following event correlation documentation for deciding on your choice: http://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation




| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: How can we join two sourcetypes together that have a common field?

Legend

As per your example

index=itsm sourcetype=tsm_filespaces  OR sourcetype=tsm_nodes node_name=* 
|stats values(filespacename) as filespacename values(platform_name) as platform_name values(backup_end) as backup_end values(host) as host by nodename 



| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: How can we join two sourcetypes together that have a common field?

Explorer

yes , I used Join ...

index=itsm sourcetype=tsm_filespaces |join node_name [search sourcetype=tsm_nodes] | dedup node_name,filespace_name | table node_name, platform_name, filespace_name,backup_end,host
0 Karma
Highlighted

Re: How can we join two sourcetypes together that have a common field?

SplunkTrust
SplunkTrust

Do nodename and filespacename fields available in same sourcetype (single) OR both sourcetypes?

0 Karma
Highlighted

Re: How can we join two sourcetypes together that have a common field?

Super Champion

try this.

index=itsm sourcetype=tsm_filespaces OR sourcetype=tsm_nodes|stats values(*) as * by node_name| dedup node_name,filespace_name | table node_name, platform_name, filespace_name,backup_end,host
0 Karma