I see a ton of these type questions, but none seem to pertain to what I am doing or I just dont understand them.
I have 2 sourcetype that have a common ID in the events,
sourcetypeA with RequestId
sourcetypeB with requestId
What I need to do is timechart by a field that only occurs in sourcetypeB but only when the corresponding request Id in sourcetypeA has a particular field value.
Hi Cuyose,
Take a look at this answer http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-joi... which also includes an example what you're trying to do. In a nutshell try something like this:
sourcetypeA OR sourcetypeB | eventstats count by RequestId requestId anyothervalue | timechart count by field where RequestId > "5"
This will only timechart
events with field
events if RequestId
is over 5
. Be reminded this is out of my head and un-tested, so you maybe need to tweak it.
cheers, MuS