Splunk Search

How to join three searches

arkonner
Path Finder

Hi,

I have three different indexes with a common field. I know how to use of the join command with two indexes with a common field.

How to do it with three?

Thank you in advance

0 Karma

acharlieh
Influencer

join is used to merge results from two different searches, and any single search could return data from across multiple indexes for example:

(index=a OR index=b OR index=c) common_field=* | fields common_field, interesting_field1,interesting_field2,...,interesting_fieldN | stats values(*) as * by common_field

This search will pull data from three indexes with a common field, limit the extractions to the common field and N interesting fields, then get the values of each interesting field from across all indexes with the common field, and would as a rule of thumb would perform much faster than an equivalent join.

But recommendations on how you should proceed in joining the multiple data sets, depends heavily on both what your data sources are (what kind of data are in the three indexes), and what your goal is in using the join command. With enough background, people would then be able to better develop an appropriate use of join, or figure out if other techniques are better.

MuS
SplunkTrust
SplunkTrust

in addition: it is always a pleasure to direct to this answer http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-joi... 🙂

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...