i am trying to write a single query like below, Id is the common field in all the queries.
query1 + join[query 2], query1 + join[query3]
Able to join query1 with query2 but not sure how to join query1 with query3 in a single query..can someone pls help
Once queries 1 and 2 are joined, you no longer have a query1. That said, the general form for joining 3 queries is
query1
| join [query2]
| join [query3]
Include field names in each join so Splunk knows how you want to match up the results from each query.
Know that the join command is slow and inefficient with a limit of 50,000 results from each subquery. Consider the stats command as another way to merge query results.