How to group two field values into separate fields?

bofasplunkguy — Tue, 25 Jun 2019 13:31:37 GMT

I am working with data that is shared/backed up by two separate hosts. Each userID is linked to two hosts. When there are data issues (server outages, etc), a certain error on the host is triggered. I need to find out when the error is triggered for BOTH hosts at the same time. The error may be triggered every 5 minutes, so I need a table showing each userID, the two hosts that map to that user, and each timestamp that is within 5 seconds (due to latency timestamp may not match exactly).

Therefore, I believe I somehow need to separate the two hosts into separate fields, but am not sure the best way to do this.
The psuedo code would look like:

for each userID{
   if (host1 != host2 && abs(host1.timestamp-host2.timestamp) <= 5 && host1.error==host2.error){
         return (userID, host1,  host2, timestamp) 
   }
}

Is there a way in Splunk that I can generate this table by comparing timestamps of the two hosts that are connected to the userID?

topic How to group two field values into separate fields? in Splunk Search

How to group two field values into separate fields?