Splunk Search

Combine historical and realtime data from different data types

SplunkHead10
Explorer

Hello community,

I used the search to find a possible solution for my problem but without success. 
My problem looks the following: 

1. I have historical data from a storage sytem which contains the date and the amount used storage (column name historical_gb). This data is in .csv and therefore easy to read. 
2. In addition I get the realtime amount of used storage (live_gb) via a REST API. This data is in .json.

My question would be:
How can I combine those two data sources? 
The final search should look like:

dateusedStorage 
01.01.2020110 GBsource: historical_gb
19.10.2020125 GBsource: live_gb

 

I added the last column just for better understanding. The column is not relevant for the actual search. 

So far I have: 

index="test" (source = Used_Sotrage_KPI objid = 18392 ) OR (source="historicdata.csv") | rename lastvalue_raw as usedStorage | rename "PhysUsedCapacity_Raw" as usedStorage | timechart span=1d max(usedStorage)

lastvalue_raw = realtime data (source: Used_Storage_KPI)
PhysUsedCapacity_Raw = historical data (source: histrocialdata.csv)

But the second rename overwrites the first rename statement. 

Thanks for your help!

Labels (5)
1 Solution

SplunkHead10
Explorer

This worked for me:

index="test" (source = Used_Sotrage_KPI objid = 18392) OR (source="historicdata.csv") | eval usedStorage = mvappend(lastvalue_raw, 'PhysUsedCapacity_RAW')  | timechart span=1d max(usedStorage)

View solution in original post

SplunkHead10
Explorer

This worked for me:

index="test" (source = Used_Sotrage_KPI objid = 18392) OR (source="historicdata.csv") | eval usedStorage = mvappend(lastvalue_raw, 'PhysUsedCapacity_RAW')  | timechart span=1d max(usedStorage)
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...