I have two different source types Source A & B. 'ID' is the common field in both sources.
For each 'ID' in source A, multiple records will be in source B.
i want to fetch all the records from source A and latest matching record by compare the timestamp field value of source B.
How to make join like primary key and foreign key join in SQL.
First, go read this one. Thinking about SQL's way of doing things will just mess you up over here.
https://answers.splunk.com/answers/561130/sql-analogy-for-my-log-search-join-two-tables-wher.html
Second, here's another reference answer for how to combine one record with the latest matching record
https://answers.splunk.com/answers/561578/map-fields-from-two-sourcetypes-based-on-a-certain.html