topic Join by time range in Splunk Search

Join by time range

stwong — Wed, 28 Oct 2020 11:15:56 GMT

Hi all,

Possible to join 2 search results like following?

Set 1:

_time

field1

field2

field3 (common field)

Set 2:

_time

fieldA (multiple values, contains start/end time)

fieldB

field3 (common field)

Then join with common field3, together with:

fieldA (start) < _time (Set1) < fieldA (end)

Thanks a lot.

Regards

/stwong

ITWhisperer — Wed, 28 Oct 2020 11:20:46 GMT

Rename _time in query 2 as part of the join, then you will be able to do your comparison / filter after the join

stwong — Thu, 29 Oct 2020 03:10:34 GMT

Thanks. Seems if join first with common field3, unable to do filter afterwards. Would you advise how? Sorry for the newbie question.

Thanks.

ITWhisperer — Thu, 29 Oct 2020 08:55:57 GMT

@stwong I don't understand what you mean. Perhaps if you gave some concrete examples of your queries and data we might be able to help more.