https://community.splunk.com/t5/Splunk-Search/Join-and-a-Transaction-with-time-within-minute/m-p/70015#M17545 <P>If you do a timechart over the same range with the same span twice you can use appendcols to merge them.</P> Thu, 21 Mar 2013 16:22:55 GMT martin_mueller 2013-03-21T16:22:55Z https://community.splunk.com/t5/Splunk-Search/Join-and-a-Transaction-with-time-within-minute/m-p/70014#M17544 <P>Ok folks, here's a doozy.</P> <P>Two sets of data, first set of data is needs to be evaluated by a transaction to group a long log together.</P> <P>index="main" sourcetype=APPPERF | transaction maxspan=0s startswith="Transaction arrived:" endswith="Sent transaction" | search Transaction_Name="App Test Script" | timechart span=10m values(Duration) by Transaction_Name</P> <P>From this search I can get the "Duration" that the App Test Script took.. great!</P> <P>My second set of data is bandwidth related.</P> <P>index=nagios | sort _time| delta inAbsolut as inabs_change| delta outAbsolut as outabs_change| where inabs_change&gt;=0| where outabs_change&gt;=0| eval inkilobits=(inabs_change*8/1000)| eval outkilobits=(outabs_change*8/1000)| timechart span=1m per_second(inkilobits) as in_kbps, per_second(outkilobits) as out_kbps</P> <P>From this search (found on splunkbase) I am getting my firewall current bandwidth. I've been somewhat successful joining these two together by _time, but my problem with that is that my bandwidth polling and app perf polling are not in sync, so I may only get 2 or 3 records to match.</P> <P>I'm open to any suggestions on how to get these two data sets into a timechart.</P> Mon, 28 Sep 2020 13:34:15 GMT https://community.splunk.com/t5/Splunk-Search/Join-and-a-Transaction-with-time-within-minute/m-p/70014#M17544 dgshue 2020-09-28T13:34:15Z https://community.splunk.com/t5/Splunk-Search/Join-and-a-Transaction-with-time-within-minute/m-p/70015#M17545 <P>If you do a timechart over the same range with the same span twice you can use appendcols to merge them.</P> Thu, 21 Mar 2013 16:22:55 GMT https://community.splunk.com/t5/Splunk-Search/Join-and-a-Transaction-with-time-within-minute/m-p/70015#M17545 martin_mueller 2013-03-21T16:22:55Z