How can we join fields of two source types, when one field is the same in both source types?
try this.
index=itsm sourcetype=tsm_filespaces OR sourcetype=tsm_nodes|stats values(*) as * by node_name| dedup node_name,filespace_name | table node_name, platform_name, filespace_name,backup_end,host
yes , I used Join ...
index=itsm sourcetype=tsm_filespaces |join node_name [search sourcetype=tsm_nodes] | dedup node_name,filespace_name | table node_name, platform_name, filespace_name,backup_end,host
Do node_name and filespace_name fields available in same sourcetype (single) OR both sourcetypes?
There could be multiple ways
Easiest to do might be through transaction
sourcetype="srcType1" OR sourcetype="srcType2" commonField=*
| transaction commonField
| table _time, eventcount, duration, _raw
However, stats might perform better based on use case. You will have to use combinations of first(), last(), min(), max() or values() etc for various fields that you want to work on after correlation
sourcetype="srcType1" OR sourcetype="srcType2" commonField=*
| stats count as eventcount by commonField
| search eventcount>1
You can also use append, appendcols, appendpipe, join,lookup etc based on your needs.
Refer to the following event correlation documentation for deciding on your choice: http://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation
As per your example
index=itsm sourcetype=tsm_filespaces OR sourcetype=tsm_nodes node_name=*
|stats values(filespacename) as filespacename values(platform_name) as platform_name values(backup_end) as backup_end values(host) as host by nodename
There are various methods for it and which one will be best depends upon the output that you expect after joining them. Could you explain more on what is your end goal after joining those two sourcetype's data?
Are you looking for something like
(sourcetype=A OR sourcetype=B) commonfield=<value>
OR
(sourcetype=A OR sourcetype=B) |stats values(commonfield)
I want to make sure I understand.
You have Sourcetype A and Sourcetype B and both of them have Field X and you want to join these two sourcetypes together based on Field X?