I have a search that has 3 joins.
search1 | join common_field1 [search2] | join commonfield2 [search3] | table field1, field2, field3, field4
Search1 and Search2 have some fields that have the same name. Search2 and Search3 have some fields that have the same name.
How does Splunk decide which field to use on the table?
Thanks!
The default behavior for "join" is to overwrite the shared fields with the results of each join; however, you can override this with the overwrite option:
... | join common_field1 overwrite=f [search2]
Help on JOIN is provided here:
http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Join
The default behavior for "join" is to overwrite the shared fields with the results of each join; however, you can override this with the overwrite option:
... | join common_field1 overwrite=f [search2]
Help on JOIN is provided here:
http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Join