How to do cross-app join?

[DrColombes]

In Splunk 4.3 I want to do a join of an regex-extracted variable A (belonging to app/sourcetype a) with a variable B (belonging to app/sourcetype b).

I've tried several variations of something like this:

sourcetype="a" < ... extracted search for variable A ...> | rename A as C | join C
[ | rename sourcetypeb:B as C ]

but can't quite get the right answer (an inner join). Note the use of the qualifier soucetypeb:B to define the subsearch variable B. At least Splunk isn't complaining about a syntax error, so I think I'm on the right track.

(The subsearch hasn't run up against the 60-second limit.)

Thanks for any help you can offer.

[Stephen_Sorkin]

The typical way to do a join in splunk is via disjunction and stats, rather than relational join. For example:

(sourcetype=a ...) OR (sourcetype=b ...)
| eval c=if(sourcetype=="a", field_a, field_b)
| stats values(x) values(y) values(z) by c

Of course, you probably want to use the appropriate aggregator in the stats, to pick the fields that you're interested in and combine the (possibly) several values in the right way.