I'd like to be able to historically search my events and be able to correlate events from 2 different sources. One source is a dhcp log which stores ips and hostnames that are time-specific.
Is there a command that I can use to specify how close the events must be to match? I guess I'm looking for something similar to maxspan in transaction. But I don't want to use transaction due to the expense.
Its not apparent to me what the value of "log2" should be in your example.
Here is a link to an Answer from Stephen Sorkin.
http://splunk-base.splunk.com/answers/103/transaction-vs-stats-commands
I believe you can use the "stats range" instead of transaction but it depends on the data. Here is an example:
... | transaction trade_id | chart count by duration span=log2
is the same as:
... | stats range(_time) as duration by trade_id | chart count by duration span=log2