Splunk Search

How do you plot historical data and current log data together in a timechart?

arpitadu
Explorer

Hi all,

I have loaded the last 3 years of historical data from a CSV file to Splunk — so source is "XYZ.csv". On the other hand, the recent log data is tracking every 30 mins through a REST API — thus its source is ""rest://XYZ".

Can you please advise how I can plot a timechart with both data sets together?

0 Karma
1 Solution

whrg
Motivator

Do both log sources (CSV and REST API) have the same log format, i.e. do they have the same fields available?

If so, I suggest you run two searches to combine all events and then run the timechart command:

index=... sourcetype="XYZ.csv"
| append [search index=... sourcetype="rest://XYZ"]
| timechart ...

EDIT: I just thought of something much simpler:

index=... sourcetype="XYZ.csv" OR sourcetype="rest://XYZ"

View solution in original post

whrg
Motivator

Do both log sources (CSV and REST API) have the same log format, i.e. do they have the same fields available?

If so, I suggest you run two searches to combine all events and then run the timechart command:

index=... sourcetype="XYZ.csv"
| append [search index=... sourcetype="rest://XYZ"]
| timechart ...

EDIT: I just thought of something much simpler:

index=... sourcetype="XYZ.csv" OR sourcetype="rest://XYZ"

whrg
Motivator

I just edited my answer to include a much simpler search using "OR".

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...