Hi,
I just started working with Splunk and would ask for some help.
I have 3 sources, A, B and C.
Source A contains fields Ordernr, Salesvalue
Source B contains fields Ordernr, Status
Source C contains fields Ordernr, Producttype
All sources have around few million records.
What i would like to get is a result set with:
A.Ordernr, A.Salesvalue, C.Producttype
where
A.Ordernr not exists in B.Status=700
and A.Ordernr exists in C.Ordernr
Hope my question is clear
Thanks in advance for helping me out!
What i would like to do is to have a resul
You could try something along these lines
search Source A
| table Ordernr, Salesvalue
| join type=left Ordernr [search Source B
| table Ordernr, Status]
| fillnull value=700 Status
| join Ordernr [search Source C
| table Ordernr, Producttype]
Although given the limitations of joins, you could try something like this
search Source A
| table Ordernr, Salesvalue
| append [search Source B
| table Ordernr, Status]
| fillnull value=700 Status
| append [search Source C
| table Ordernr, Producttype]
| stats values(Salesvalue) as Salesvalue values(Status) as Status by Ordernr
| where isnotnull(Salesvalue)
You could try something along these lines
search Source A
| table Ordernr, Salesvalue
| join type=left Ordernr [search Source B
| table Ordernr, Status]
| fillnull value=700 Status
| join Ordernr [search Source C
| table Ordernr, Producttype]
Although given the limitations of joins, you could try something like this
search Source A
| table Ordernr, Salesvalue
| append [search Source B
| table Ordernr, Status]
| fillnull value=700 Status
| append [search Source C
| table Ordernr, Producttype]
| stats values(Salesvalue) as Salesvalue values(Status) as Status by Ordernr
| where isnotnull(Salesvalue)
Worked almost fine tat once, had to change the fillnull value to 0 to avoid that all orders get status 700 which not exists.
Thanks a lot helping me out!