Splunk Search

extract _time from one search and apply to another

tven7
Path Finder

vmstat , net stat is captured every minute. While access_combined has entires whenever traffic comes in (every second or more).

index=os sourcetype=vmstat host="tbbpapp1.xyz.com" |multikv

and loadAvg1mi gives me avg for that minute.

I want to take the _time from the above run the following search

index=tbb sourcetype="access_combined"|rex "10\.\d+\.\d+\.\d+\s(?P<source_ip>[\d+\.+]+)\s\[\d+"

So the basic idea is to tie load times with count of source_ips to arrive at # of http connections at _time and its corresponding load on the server.

Edit:

i could easily do
sourcetype=access_combined OR sourcetype=vmstat |_time , but then i felt the extractions would get more complicated than they need to be.

0 Karma

woodcock
Esteemed Legend

You need the map command:

index=os sourcetype=vmstat host="tbbpapp1.xyz.com" | multikv | stats last(_time) as starttime| eval endtime=starttime+10 | map search="search earliest=$starttime$ latest=$endtime$ index=tbb sourcetype=\"access_combined\"|rex \"10\.\d+\.\d+\.\d+\s(?<source_ip>[\d+\.+]+)\s\[\d+\""
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...