data joins

[friskyapple]

I've got a few different tables, all csv, that provide different information.

The main events table includes a bunch of fields that reference those other tables ie title_id field will contain a number and in the title_id table the numbers match up to a specific text value.

I have a number of these types of fields with matching tables. Is this something where i can upload all of the tables and join them in splunk, telling it how to reference? or is it something where i need to join the data external to splunk and upload it?

My goal is that when i search for something the actual title appears instead of the title id.

Sorry, i'm very new to this and super appreciate any assistance. 

[gcusello · Accepted solution]

Hi @friskyapple,

you can follow both the approaches:

• if your data are DB extraction, you could join them into the DB and then extract the joined data and upload them in Splunk;
• otherwise you can upload each csv in Splunk and join them into Splunk.

It depends on the knoledge you have in Splunk or in DB. I do all in Splunk (sometimes also joinings of Excel files!)!

Anyway, in Splunk you can join all the data using different methods:.

• you can use the join command that's very easy to use (the same od a DB), but it's a very slow command and I don't like it;
• you can use the "stats values(your-fields) AS your_fields BY  your_key" command that i usually use, that's faster but a little more complicated to use.

Ciao.

Giuseppe