Splunk Search

How to do simple join between two different source types like primary key & foreign key in SQL?

tskarthic
New Member

I have two different source types Source A & B. 'ID' is the common field in both sources.
For each 'ID' in source A, multiple records will be in source B.
i want to fetch all the records from source A and latest matching record by compare the timestamp field value of source B.
How to make join like primary key and foreign key join in SQL.

0 Karma

DalJeanis
Legend

First, go read this one. Thinking about SQL's way of doing things will just mess you up over here.

https://answers.splunk.com/answers/561130/sql-analogy-for-my-log-search-join-two-tables-wher.html

Second, here's another reference answer for how to combine one record with the latest matching record

https://answers.splunk.com/answers/561578/map-fields-from-two-sourcetypes-based-on-a-certain.html

0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...