I am tasked to correlate between two source (below) and displaying them on a timechart (line). Anyone has any idea how to do that ? I have got sourcetype="CurrentWeatherSGMap" and sourcetype="ltaTraffic" with the following data. What data will be best to correlate, I was thinking on count of Incidents and count of Rain and display a line chart showing the how weather can affect traffic incidents. Anyone has ideas to guide me along ? Thanks in advance !
/m:properties
and this
Woodlands/d:Area
You can specify multiple fields to do a timechart count.
For example:
sourcetype=CurrentWeatherSGMap OR sourcetype=ltaTraffic | timechart count(incident) as Incident count(rain) as Rain
This would produce a graph of the count of incidents versus the rain over time. However, you would need to make sure you had the fields extracted correctly. For example, you would want to make sure that if rain was in your event that you created a field called rain. The same would be true for incidents. Your data is XML so you should have some luck using either KV_MODE or xmlkv to extract out fields from the events.
If you want to learn more about field extraction you can start here:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Addfieldsatsearchtime
You can specify multiple fields to do a timechart count.
For example:
sourcetype=CurrentWeatherSGMap OR sourcetype=ltaTraffic | timechart count(incident) as Incident count(rain) as Rain
This would produce a graph of the count of incidents versus the rain over time. However, you would need to make sure you had the fields extracted correctly. For example, you would want to make sure that if rain was in your event that you created a field called rain. The same would be true for incidents. Your data is XML so you should have some luck using either KV_MODE or xmlkv to extract out fields from the events.
If you want to learn more about field extraction you can start here:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Addfieldsatsearchtime
thank you !
It is the count of event, how can I do a time-charting between two sources ?
Not sure if I got what you are after, but what about searching for both sourcetypes and then timecharting both counts? when you talk about reporting on a count of incidents and rain, do you have those values in a field or is it just the count of events??