Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Correlate between two source and displaying th...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am tasked to correlate between two source (below) and displaying them on a timechart (line). Anyone has any idea how to do that ? I have got sourcetype="CurrentWeatherSGMap" and sourcetype="ltaTraffic" with the following data. What data will be best to correlate, I was thinking on count of Incidents and count of Rain and display a line chart showing the how weather can affect traffic incidents. Anyone has ideas to guide me along ? Thanks in advance !
/m:properties
and this
Woodlands/d:Area
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can specify multiple fields to do a timechart count.
For example:
sourcetype=CurrentWeatherSGMap OR sourcetype=ltaTraffic | timechart count(incident) as Incident count(rain) as Rain
This would produce a graph of the count of incidents versus the rain over time. However, you would need to make sure you had the fields extracted correctly. For example, you would want to make sure that if rain was in your event that you created a field called rain. The same would be true for incidents. Your data is XML so you should have some luck using either KV_MODE or xmlkv to extract out fields from the events.
If you want to learn more about field extraction you can start here:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Addfieldsatsearchtime
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can specify multiple fields to do a timechart count.
For example:
sourcetype=CurrentWeatherSGMap OR sourcetype=ltaTraffic | timechart count(incident) as Incident count(rain) as Rain
This would produce a graph of the count of incidents versus the rain over time. However, you would need to make sure you had the fields extracted correctly. For example, you would want to make sure that if rain was in your event that you created a field called rain. The same would be true for incidents. Your data is XML so you should have some luck using either KV_MODE or xmlkv to extract out fields from the events.
If you want to learn more about field extraction you can start here:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Addfieldsatsearchtime
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thank you !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It is the count of event, how can I do a time-charting between two sources ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not sure if I got what you are after, but what about searching for both sourcetypes and then timecharting both counts? when you talk about reporting on a count of incidents and rain, do you have those values in a field or is it just the count of events??
Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain
Splunk Lantern’s Guide to The Most Popular .conf25 Sessions
Unlock What’s Next: The Splunk Cloud Platform at .conf25
