topic Re: How do you plot historical data and current log data together in a timechart? in Splunk Search

How do you plot historical data and current log data together in a timechart?

arpitadu — Mon, 10 Dec 2018 19:57:40 GMT

Hi all,

I have loaded the last 3 years of historical data from a CSV file to Splunk — so source is "XYZ.csv". On the other hand, the recent log data is tracking every 30 mins through a REST API — thus its source is ""rest://XYZ".

Can you please advise how I can plot a timechart with both data sets together?

Re: How do you plot historical data and current log data together in a timechart?

whrg — Mon, 10 Dec 2018 20:35:26 GMT

Do both log sources (CSV and REST API) have the same log format, i.e. do they have the same fields available?

If so, I suggest you run two searches to combine all events and then run the timechart command:

index=... sourcetype="XYZ.csv"
| append [search index=... sourcetype="rest://XYZ"]
| timechart ...

EDIT: I just thought of something much simpler:

index=... sourcetype="XYZ.csv" OR sourcetype="rest://XYZ"

Re: How do you plot historical data and current log data together in a timechart?

whrg — Mon, 10 Dec 2018 21:02:13 GMT

I just edited my answer to include a much simpler search using "OR".