Splunk Search

Join and a Transaction with _time within minute?

dgshue
New Member

Ok folks, here's a doozy.

Two sets of data, first set of data is needs to be evaluated by a transaction to group a long log together.

index="main" sourcetype=APPPERF | transaction maxspan=0s startswith="Transaction arrived:" endswith="Sent transaction" | search Transaction_Name="App Test Script" | timechart span=10m values(Duration) by Transaction_Name

From this search I can get the "Duration" that the App Test Script took.. great!

My second set of data is bandwidth related.

index=nagios | sort _time| delta inAbsolut as inabs_change| delta outAbsolut as outabs_change| where inabs_change>=0| where outabs_change>=0| eval inkilobits=(inabs_change*8/1000)| eval outkilobits=(outabs_change*8/1000)| timechart span=1m per_second(inkilobits) as in_kbps, per_second(outkilobits) as out_kbps

From this search (found on splunkbase) I am getting my firewall current bandwidth. I've been somewhat successful joining these two together by _time, but my problem with that is that my bandwidth polling and app perf polling are not in sync, so I may only get 2 or 3 records to match.

I'm open to any suggestions on how to get these two data sets into a timechart.

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If you do a timechart over the same range with the same span twice you can use appendcols to merge them.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...