Splunk Search

Using two sourcetypes - lookup



there are two sourcetypes A & B which I want to use a search. Both them have a field userid.

Let's say sourcetype A tells us userId=1 is from country=US. In sourcetype B the field country does not exist. Is there a possibility to do a lookup in search time, that the country is added for all events of userid=1 in sourcetype B as well?

It would be possible to run a search for sourcetype A and create a lookup.csv.


And use this csv in a next step:

sourcetype=A OR sourcetype=B | lookup lookup.csv userid OUTPUT country

But I think there is a better/easier way which I don't know 🙂

BR Heinz

Tags (2)
0 Karma

Revered Legend

Try this

sourcetype=A OR sourcetype=B | eventstats first(country) as userCountry by userid | eval country=coalesce(country,userCountry) |...

another option:

sourcetype=A OR sourcetype=B | streamstats first(country) as country by userid | .....


In the end I want to calculate different stats by country. To include data from sourcetype B as well, I need the field country for the userids in this sourcetype.

0 Karma

Revered Legend

There may be a better solution if you could tell what is the ultimate requirement? Sample output or something? (I am sure, you don't just want to see the data in raw format)

0 Karma


thanks, this works as well. but in my experience eventstats is veeery slow, so I would like to avoid it if possible

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!