Splunk Search

How to join three searches

arkonner
Path Finder

Hi,

I have three different indexes with a common field. I know how to use of the join command with two indexes with a common field.

How to do it with three?

Thank you in advance

0 Karma

acharlieh
Influencer

join is used to merge results from two different searches, and any single search could return data from across multiple indexes for example:

(index=a OR index=b OR index=c) common_field=* | fields common_field, interesting_field1,interesting_field2,...,interesting_fieldN | stats values(*) as * by common_field

This search will pull data from three indexes with a common field, limit the extractions to the common field and N interesting fields, then get the values of each interesting field from across all indexes with the common field, and would as a rule of thumb would perform much faster than an equivalent join.

But recommendations on how you should proceed in joining the multiple data sets, depends heavily on both what your data sources are (what kind of data are in the three indexes), and what your goal is in using the join command. With enough background, people would then be able to better develop an appropriate use of join, or figure out if other techniques are better.

MuS
Legend
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...