Splunk Search

How to do multi join in a single query

ajee_villa
Observer

i am trying to write a single query like below, Id is the common field in all the queries.

query1 + join[query 2], query1 + join[query3] 

Able to join query1 with query2 but not sure how to join query1 with query3 in a single query..can someone pls help

Labels (4)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Once queries 1 and 2 are joined, you no longer have a query1.  That said, the general form for joining 3 queries is

query1
| join [query2]
| join [query3]

Include field names in each join so Splunk knows how you want to match up the results from each query.

Know that the join command is slow and inefficient with a limit of 50,000 results from each subquery.  Consider the stats command as another way to merge query results.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...