Search Multiple Sourcetypes using different fields - return all rawevent information for all sourcetypes

[jeurich]

I need help figuring out the best way to get the information I want in one query.

I have indexA with sourcetypeA, sourcetypeB and sourcetypeC. I also have indexB with sourcetypeD.

I input two values to search for within sourcetypeA. The results will give me three fields that I need to use to search the remaining sourcetypes. I want the results return the raw events for all instances that are found.

basically - sourcetypeA contains field1, field2, field3
sourcetypeB and sourcetypeC contain field1, field2, field3. But I need the output from sourcetypeA (field1, field2, field3) in order to search sourcetypeB and sourcetypeC for matching fields.
sourcetypeD contains field2 and field3 - I need the output from sourcetypeA or sourcetypeB to search for field2 and field3 in sourcetypeD

Here is what i have tried and only gotten part of what i want. (there have been numerous attempts to figure this out).

sourcetype=logA input1=NAME input2=ADDRESS | join type=outer field2 [search sourcetypeD]

[tiagofbmm]

Use the return function.

sourcetypeB
[ search index=indexA sourcetype=sourcetypeA
| dedup fieldA, fieldB, fieldC
| return fieldA, fieldB, fieldC]
| append [sourcetypeC
[ search index=indexA sourcetype=sourcetypeA
| dedup fieldA, fieldB, fieldC
| return fieldA, fieldB, fieldC]]

[tiagofbmm]

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that