Splunk Search

How to combine data in a table from two or more sourcetypes?

ArsenyKapralov
Path Finder

Hi
I have data in 3 sourcetypes where all fields named differently. I need to combine it to show in one table. Can you please help me to do this?

Sourcetype 1: fields HostName and ReportingTime

Sourcetype 2: fields MachineName and LastReported

Sourcetype 3: fields Host and time.

I want to have the following: Hostname (combined list from 3 sources) and 3 fields with different times in one row.

Can you please help me with query or functions which will help me to do this?

Tags (2)
0 Karma
1 Solution

ArsenyKapralov
Path Finder

I resolved this simply using append command, joining data and renaming fields.

View solution in original post

0 Karma

ArsenyKapralov
Path Finder

I resolved this simply using append command, joining data and renaming fields.

0 Karma

HiroshiSatoh
Champion

Try this!

(your search)|eval Hostname=case(sourcetype=="Sourcetype 1",HostName,sourcetype=="Sourcetype 2",MachineName ,sourcetype=="Sourcetype 3",Host)|stats first(ReportingTime) as ReportingTime,first(LastReported) as LastReported,first(time) as time by Hostname

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...