Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fdataprime%2Fuser-guide%2Fusing-dataprime%2Fjoin_union.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fdataprime%2Fuser-guide%2Fusing-dataprime%2Fjoin_union.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# How to use DataPrime to combine datasets and correlate logs

## Goal[​](#goal "Direct link to Goal")

By the end of this guide you should be able to:

* Use `join` to combine logs and traces by shared fields
* Use `union` to merge datasets with compatible schemas
* Use identifier-based filtering to correlate logs without a formal join

## Why it matters[​](#why-it-matters "Direct link to Why it matters")

Real-world debugging rarely involves a single service. To understand the full picture, you often need to combine data from multiple sources—logs, traces, or metrics—based on shared identifiers like `request_id`, `trace_id`, or `user_id`. This guide helps you unify fragmented data into a cohesive timeline for triage, monitoring, and root cause analysis.

***

## Combining datasets using `join`[​](#combining-datasets-using-join "Direct link to combining-datasets-using-join")

### Description[​](#description "Direct link to Description")

The `join` command combines two datasets by matching a common field (e.g., `trace_id`, `request_id`). It's useful for enriching logs with related events from another source.

Note

Joins can be resource intensive. Try to filter as much as possible before joining.

### Syntax[​](#syntax "Direct link to Syntax")

```
<query1>

| join (

  <query2>

) on <join_condition>
```

***

## Merging datasets using `union`[​](#merging-datasets-using-union "Direct link to merging-datasets-using-union")

### Description[​](#description-1 "Direct link to Description")

The `union` command merges two datasets into a single stream. Both sources should have compatible schemas or be normalized with `choose`.

### Syntax[​](#syntax-1 "Direct link to Syntax")

```
<query1>

| union (

  <query2>

)
```

***

## Combining data across dataspaces and tiers[​](#combining-data-across-dataspaces-and-tiers "Direct link to Combining data across dataspaces and tiers")

`join` and `union` aren't limited to your `default` data. You can reference any queryable source in the same query, including:

* `default/logs`, `default/spans`, and user-defined datasets
* `frequentsearch/logs` and `frequentsearch/spans` (your High (Frequent Search) tier)
* `system/*` datasets such as `system/engine.queries`

This means you can join logs and spans wherever they sit, or union across storage tiers in a single query — for example, to compare how many records landed in Frequent Search versus your `default` dataset for the same timeframe.

### Track where each record came from[​](#track-where-each-record-came-from "Direct link to Track where each record came from")

When a query spans several datasets, use the [`dataspace()`](https://coralogix.com/docs/docs/dataprime/language-reference/functions-reference/general/dataspace/.md) and [`dataset()`](https://coralogix.com/docs/docs/dataprime/language-reference/functions-reference/general/dataset/.md) functions to attribute every record to its origin, then group by both to see the breakdown. Add [`recordLocation()`](https://coralogix.com/docs/docs/dataprime/language-reference/functions-reference/general/recordlocation/.md) if you also need the exact storage location.

```
source logs

| union (source system/engine.queries)

| union (source system/dataplan.usage_events)

| create query_source.dataspace from dataspace()

| create query_source.dataset from dataset()

| groupby query_source.dataspace, query_source.dataset agg count() as count
```

This is especially useful once data is routed across multiple streaming datasets and you need to locate where the records for a given trace ID actually live.

***

## Common pitfalls[​](#common-pitfalls "Direct link to Common pitfalls")

* **Unfiltered joins**: Always apply `filter` before `join` to avoid performance issues.
* **Mismatched schemas**: Use `choose` to normalize fields before `union`.
* **Missing correlation keys**: Without a shared ID like `request_id`, correlation is not possible.