https://community.splunk.com/t5/Splunk-Search/Join-subsearch-and-realtime/m-p/41339#M9577 <P>Does something like this work for your usecase?</P> <PRE><CODE>sourcetype="cswports" OR sourcetype="cswports-sfp" host=sanlacsw2 | stats first(_time) first(swFCPortSpecifier) first(swFCPortPhyState) first(swSFPTemp) first(swSFPVoltage) first(swSFPCurrent) by swFCPortIndex </CODE></PRE> <P>I'm not sure if you want <CODE>first()</CODE> or <CODE>last()</CODE> in your search</P> Tue, 27 Aug 2013 09:23:35 GMT dart 2013-08-27T09:23:35Z https://community.splunk.com/t5/Splunk-Search/Join-subsearch-and-realtime/m-p/41338#M9576 <P>Got 2 input datas, one pulled every two minutes and the other every 10 minutes.<BR /> I would like to have a table containing columns from the two datas (= 2 sourcetypes) <STRONG>in real-time</STRONG> </P> <P>I used appendcols like this :</P> <PRE><CODE>sourcetype="cswports" host=sanlacsw2|dedup swFCPortIndex sortby -_time|sort +swFCPortIndex | appendcols [sourcetype="cswports-sfp" host=sanlacsw2 |dedup swSFPId sortby -_time|sort +swFCPortIndex]|table _time swFCPortIndex swFCPortSpecifier swFCPortPhyState swSFPTemp swSFPVoltage swSFPCurrent </CODE></PRE> <P>But the subsearch is not in real-time.<BR /> Do you see another way?<BR /> Thxs for your help,</P> <P>Datas look like : (each line=One port)<BR /> Sourcetype=CSWPorts<BR /> <IMG src="http://splunk-base.splunk.com//storage/Capture_5.jpg" alt="alt text" /><BR /> Sourcetype=CSWPorts-SFP<BR /> <IMG src="http://splunk-base.splunk.com//storage/Capture2_1.jpg" alt="alt text" /></P> Wed, 21 Aug 2013 07:31:01 GMT https://community.splunk.com/t5/Splunk-Search/Join-subsearch-and-realtime/m-p/41338#M9576 timmalos 2013-08-21T07:31:01Z https://community.splunk.com/t5/Splunk-Search/Join-subsearch-and-realtime/m-p/41339#M9577 <P>Does something like this work for your usecase?</P> <PRE><CODE>sourcetype="cswports" OR sourcetype="cswports-sfp" host=sanlacsw2 | stats first(_time) first(swFCPortSpecifier) first(swFCPortPhyState) first(swSFPTemp) first(swSFPVoltage) first(swSFPCurrent) by swFCPortIndex </CODE></PRE> <P>I'm not sure if you want <CODE>first()</CODE> or <CODE>last()</CODE> in your search</P> Tue, 27 Aug 2013 09:23:35 GMT https://community.splunk.com/t5/Splunk-Search/Join-subsearch-and-realtime/m-p/41339#M9577 dart 2013-08-27T09:23:35Z https://community.splunk.com/t5/Splunk-Search/Join-subsearch-and-realtime/m-p/41340#M9578 <P>was last() but thks !</P> Tue, 27 Aug 2013 12:13:57 GMT https://community.splunk.com/t5/Splunk-Search/Join-subsearch-and-realtime/m-p/41340#M9578 timmalos 2013-08-27T12:13:57Z