Getting Data In

How to search events in two sources using timestamp

rahumadad
New Member

Hi Guys, Im wanted to search certain events that may happened during certain timestamps.

Example I have the timestamp and the speed of this vehicule in one source and in the other i have the oil temperature of this vehicule and also the timestamp, how can I want to search the temperature of the oil between 80-100 degrees?

is this possible?

Thanks,

0 Karma

HiroshiSatoh
Champion

You will get a time stamp of 80-100 degrees by sub search.

(your search speed log) 
   [search (your search temperature log) degrees>=80 degrees<=100 
         |stats earliest(_time) as earliest,latest(_time) as latest|eval latest=latest+1
         | format "(" "(" "" ")" "OR" ")"]

Be expanded
(your search speed log) earliest=xxxx latest=xxxx

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...