How to search for a event which is having multiple sourcetypes

[rkishoreqa]

I have a requirement to find the duplicate events which are logged in Splunk with multiple sourcetypes.
For each log we have a unique id : 8b18881a-c6fe-4561-91f3-61c31b1afef5.  I am able to get the logs with this unique id (multiple logs with different sourcetypes)

Is there any way to find the sourcetypes which are having the unique id, like as below.

unique id                                                                                  sourcetype1    sourcetype2           sourcetype2
8b18881a-c6fe-4561-91f3-61c31b1afef5             st_dev                st1_dev1
21edc48b-0d90-43f2-bc1f-3dc6e322c821          st_dev                st1_dev1                    st3_dev3

[richgalloway · Accepted solution]

Try this

<your search>
| stats values(sourcetype) as sourcetypes by unique_id