So I have 4 data sources defined on Tableau Server whose data source is splunk and are configured to perform an incremental refresh daily. The data columns/format is identical for each however each data set requires different queries in splunk hence the 4 data sources. The data represents website usage with each of the 4 sources representing user activity but for 4 different features in the website.
SO....my goal is to merge/blend the data from these 4 sources to create a common report, effectively a union of the data. I know i could accomplish this with files but given I have the data sources already defined and tied to splunk and the accompanying refresh (which seems to only support 1:1), I'm a bit stuck. Does anyone have suggestions on how to blend/merge the data from 4 separate data sources or an alternative configuration that may work though still leverages the automated splunk refresh?
One solution you may try is to have a general data source which has all the join key from other 4 data source and use this as primary data source and blend other 4 using the key.
Hope this could help