There are two types of messages I'd like to correlate in my logs: An occasional message reporting an integer for the load my server is under Common messages saying how long it took to execute certain operations in my app I need a scatter chart showing the server load on one axis, and operation time in seconds on the other, with the points in the chart showing the load vs execution time of the operations. The problem I'm having is, the field that announces the server load is not included in the same messages that announce the elapsed time for that particular operation. So when I'm searching for operations, I need a way to assign the last server load value that was logged before each operation message, to each individual operation message. Let me know if this doesn't make sense :). I've been having a rough time working it out. ... View more

My log messages have two fields I'd like to search on: engineElapsed and serviceElapsed. I'm interested in looking at all the records where engineElapsed - serviceElapsed > 1. I'm new to Splunk, and have discovered I can do do something like this: * | eval time=engineElapsed-serviceElapsed | timechart avg(time) by user But since I need to see individual log messages, something like this might be more suited -- if it worked, that is: eval(engineElapsed-serviceElapsed) Help would be appreciated 🙂 ... View more