Getting Data In

How to search events in two sources using timestamp

rahumadad
New Member

Hi Guys, Im wanted to search certain events that may happened during certain timestamps.

Example I have the timestamp and the speed of this vehicule in one source and in the other i have the oil temperature of this vehicule and also the timestamp, how can I want to search the temperature of the oil between 80-100 degrees?

is this possible?

Thanks,

0 Karma

HiroshiSatoh
Champion

You will get a time stamp of 80-100 degrees by sub search.

(your search speed log) 
   [search (your search temperature log) degrees>=80 degrees<=100 
         |stats earliest(_time) as earliest,latest(_time) as latest|eval latest=latest+1
         | format "(" "(" "" ")" "OR" ")"]

Be expanded
(your search speed log) earliest=xxxx latest=xxxx

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...