topic JOIN on "_time +- 3sec" in Splunk Search

JOIN on "_time +- 3sec"

BOstermeier — Wed, 14 Feb 2018 10:11:27 GMT

Hi, I'm new to splunk 🙂

This is my query:
* Tagname="series" Wert="54" | JOIN _time [SEARCH Tagname="workload" ] | CHART VALUES(Wert) BY _time *

Goal:
The query above got me nearly 75% of my events. But sometimes the timestamp differs a little bit, so I need to have a tolerance range with +/- 3 seconds for "_time" .

How can I achieve this?

Thanks for your help,
Bastian

Re: JOIN on "_time +- 3sec"

adonio — Wed, 14 Feb 2018 11:19:14 GMT

hello there,
it is a little unclear to me if there are 3 fields: "key" "value" and "time" which are all fields, or there are more fields such as "named" which 'series' is a value of and andl "workload" is a field
if the latter, try this search: index=<your_index> sourcetype=<your_sourcetype> named="series" value="54" workload="*" | stats values(workload) as unique_workloads | mvexpand unique_workloads

hope it helps

Re: JOIN on "_time +- 3sec"

BOstermeier — Wed, 14 Feb 2018 11:56:11 GMT

No there are not other fields. field1="workload" and field2="series"

Re: JOIN on "_time +- 3sec"

adonio — Wed, 14 Feb 2018 12:02:53 GMT

try searching workload=* series=* | bin span=1m _time | stats values(workload) as unique_workloads by _time
hope i understand the question ....

Re: JOIN on "_time +- 3sec"

BOstermeier — Wed, 21 Feb 2018 14:35:28 GMT

Thanks for your answer adonio: I think you got me wrong workload and series are not fields...

I have updated my question and also added a SQL Pseudocode. Do you understand it better now?

Re: JOIN on "_time +- 3sec"

yannK — Thu, 22 Feb 2018 18:06:36 GMT

Could it be the same situation that this one : to pick one event, then run a second search to find the events "around" that event.

https://answers.splunk.com/answers/136791/use-a-subsearch-to-define-earliest-and-latest-for-main-search.html

Re: JOIN on "_time +- 3sec"

BOstermeier — Fri, 23 Feb 2018 07:27:09 GMT

That goes in the right direction - However it does not fully complete my needs, because it is filtering on a fix amount of results and only in a certain timespan. I want to get always and the timespan should only be respective to the results found in search 1.

-> I have updated the question - I was able to get my results with a join (but not unfortunatly not all of them). Can you help here also?