you need Table C = Table A + additional field, then do this: index ="A" sourcetype = A OR sourcetype = B | fields deviceName, physicalElementId, physicalType, productFamily, productId, productType, serialNumber, devProductId] | stats max(*) as * by deviceName ... View more

instead of join, it may be more efficient to use lookup command. E.g. index ="12345" sourcetype = "system_database" | lookup manual_db.csv deviceName | lookup manual_software_db.csv productFamily | lookup manual_software_db.csv | search swType=105 ... Every subsearch is a search which needs to complete before Splunk can proceed to the next step so it is always a good idea to reduce the number of joins/subsearches wherever possible. ... View more