I'm trying to join the result of three different sourcetypes into one result. These three sourcetypes are connected by different ids. One of the sourcetypes contains all the ids which are used to connect the different sourcetypes.
sourcetype=doc:
doc_id, sgn_id, rcr_id, psn_id
sourcetype=docstats:
status, doc_id
sourcetype=reference:
refstats, service, date, sgn_id
sourcetype=type:
type, rcr_id
What I would like to see is a table with the following information:
doc_id, status, refstats, service, date, type
I am able to join two sourcetypes by one id using the stats command, but doing this on more than one sourcetype with different ids is where I get lost. I searched through previous answers, but can’t seem to find a similar case.
Does anyone have any tips on how I would be able to achieve this?
By the way, using the join command isn’t an option since the sourcetypes contain more than 50000 rows.
... View more