Splunk Search

Correlate between two source and displaying them on timechart (line)

Communicator

I am tasked to correlate between two source (below) and displaying them on a timechart (line). Anyone has any idea how to do that ? I have got sourcetype="CurrentWeatherSGMap" and sourcetype="ltaTraffic" with the following data. What data will be best to correlate, I was thinking on count of Incidents and count of Rain and display a line chart showing the how weather can affect traffic incidents. Anyone has ideas to guide me along ? Thanks in advance !


http://datamall.mytransport.sg/LTAoDataService.svc/IncidentSet(2890113)
(10/7)16:34 Heavy Traffic on CTE (towards SLE) between Merchant Rd Exit and Moulmein Rd Exit.


2013-07-10T10:10:28Z







2890113/d:IncidentID
(10/7)16:34 Heavy Traffic on CTE (towards SLE) between Merchant Rd Exit and Moulmein Rd Exit./d:Message
1.3214362736951211/d:Latitude
103.85607307663071/d:Longitude
Heavy Traffic/d:Type

2013-07-10T10:06:05.277/d:CreateDate
0/d:Distance
/m:properties

1.3214362736951211/geo:lat
103.85607307663071/geo:long

and this

2013-07-10T10:05:51Z







1317369/d:NowcastID
Woodlands/d:Area
Partly Cloudy/d:Condition
1.44043052/d:Latitude
103.7878418/d:Longitude

Partly Cloudy/d:Summary
0/d:Distance

1 Solution

Splunk Employee
Splunk Employee

You can specify multiple fields to do a timechart count.

For example:

sourcetype=CurrentWeatherSGMap OR sourcetype=ltaTraffic  |  timechart count(incident) as Incident count(rain) as Rain

This would produce a graph of the count of incidents versus the rain over time. However, you would need to make sure you had the fields extracted correctly. For example, you would want to make sure that if rain was in your event that you created a field called rain. The same would be true for incidents. Your data is XML so you should have some luck using either KV_MODE or xmlkv to extract out fields from the events.

If you want to learn more about field extraction you can start here:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Addfieldsatsearchtime

View solution in original post

Splunk Employee
Splunk Employee

You can specify multiple fields to do a timechart count.

For example:

sourcetype=CurrentWeatherSGMap OR sourcetype=ltaTraffic  |  timechart count(incident) as Incident count(rain) as Rain

This would produce a graph of the count of incidents versus the rain over time. However, you would need to make sure you had the fields extracted correctly. For example, you would want to make sure that if rain was in your event that you created a field called rain. The same would be true for incidents. Your data is XML so you should have some luck using either KV_MODE or xmlkv to extract out fields from the events.

If you want to learn more about field extraction you can start here:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Addfieldsatsearchtime

View solution in original post

Communicator

thank you !

0 Karma

Communicator

It is the count of event, how can I do a time-charting between two sources ?

0 Karma

Builder

Not sure if I got what you are after, but what about searching for both sourcetypes and then timecharting both counts? when you talk about reporting on a count of incidents and rain, do you have those values in a field or is it just the count of events??

0 Karma