Splunk Search

How to combine or join 2 sources (.csv format) with exactly the same extracted fields?

krown
Explorer

How is it possible to combine or join 2 sources (.csv format) with excactly the same extracted fields?

source1: column1,column2,column3
source2: column1,column2,column3

In my example, the first column from each source just shows milliseconds and is absolutely equal -> column1 (source1) = column1 (source2) <- these fields I want to overlay. The values from column2 and column3 differs.

I now want to have a table in this format:
column1 column2 column2 column3 column3

Then I could compare the values from column2 with each other and the values from column3 with each other in a line chart while x-axis = column1. Also, it would be nice, if there is a y-axis for the values of column2 and another y-axis for column3, combined in one chart

Thanks in advance!!

Example in Excel

http://up.picr.de/23281724qw.jpg

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

(base search temrs source=source1.csv) OR (base search temrs source=source1.csv) | table source column1 column2 column3 | chart values(*) as * by column1 source

View solution in original post

somesoni2
Revered Legend

Try something like this

(base search temrs source=source1.csv) OR (base search temrs source=source1.csv) | table source column1 column2 column3 | chart values(*) as * by column1 source

krown
Explorer

I did it! With your help!

(index="yourindex" source="/home/...csv") OR (index="yourindex" source="/home/...csv") | chart values(speed) by yourtimestamp source

Thank you very much

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...