Splunk Search

How to do multi join in a single query

ajee_villa
Observer

i am trying to write a single query like below, Id is the common field in all the queries.

query1 + join[query 2], query1 + join[query3] 

Able to join query1 with query2 but not sure how to join query1 with query3 in a single query..can someone pls help

Labels (4)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Once queries 1 and 2 are joined, you no longer have a query1.  That said, the general form for joining 3 queries is

query1
| join [query2]
| join [query3]

Include field names in each join so Splunk knows how you want to match up the results from each query.

Know that the join command is slow and inefficient with a limit of 50,000 results from each subquery.  Consider the stats command as another way to merge query results.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...