multiple sources

[Wilfred]

Hi,

I just started working with Splunk and would ask for some help.

I have 3 sources, A, B and C.

Source A contains fields Ordernr, Salesvalue 

Source B contains fields Ordernr, Status

Source C contains fields Ordernr, Producttype 

All sources have around few million records.

What i would like to get is a result set with:

A.Ordernr, A.Salesvalue, C.Producttype 

where

A.Ordernr not exists in B.Status=700

and A.Ordernr exists in C.Ordernr

Hope my question is clear 

Thanks in advance for helping me out!

What i would like to do is to have a resul

[ITWhisperer · Accepted solution]

You could try something along these lines

search Source A
| table Ordernr, Salesvalue 
| join type=left Ordernr [search Source B
  | table Ordernr, Status]
| fillnull value=700 Status
| join Ordernr [search Source C
  | table Ordernr, Producttype] 

Although given the limitations of joins, you could try something like this

search Source A
| table Ordernr, Salesvalue 
| append [search Source B
  | table Ordernr, Status]
| fillnull value=700 Status
| append [search Source C
  | table Ordernr, Producttype] 
| stats values(Salesvalue) as Salesvalue values(Status) as Status by Ordernr
| where isnotnull(Salesvalue)

[Wilfred]

Worked almost fine tat once, had to change the fillnull value to 0 to avoid that all orders get status 700 which not exists.

Thanks a lot helping me out!