Getting Data In

How to join match on closest time?

finchy
Explorer

Hi,

After some advice please.  I am using a left join with Max=0 as need to find some events over a 24 hour period, however a user may have more than one event in the subsearch but i need to match on the closest time to my main search.

Not sure what's the best approach to make that match?

Lee

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This is a rather generic question - as a generic answer, the best approach is to avoid using join if you can.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...