Splunk Search

How do you plot historical data and current log data together in a timechart?

arpitadu
Explorer

Hi all,

I have loaded the last 3 years of historical data from a CSV file to Splunk — so source is "XYZ.csv". On the other hand, the recent log data is tracking every 30 mins through a REST API — thus its source is ""rest://XYZ".

Can you please advise how I can plot a timechart with both data sets together?

0 Karma
1 Solution

whrg
Motivator

Do both log sources (CSV and REST API) have the same log format, i.e. do they have the same fields available?

If so, I suggest you run two searches to combine all events and then run the timechart command:

index=... sourcetype="XYZ.csv"
| append [search index=... sourcetype="rest://XYZ"]
| timechart ...

EDIT: I just thought of something much simpler:

index=... sourcetype="XYZ.csv" OR sourcetype="rest://XYZ"

View solution in original post

whrg
Motivator

Do both log sources (CSV and REST API) have the same log format, i.e. do they have the same fields available?

If so, I suggest you run two searches to combine all events and then run the timechart command:

index=... sourcetype="XYZ.csv"
| append [search index=... sourcetype="rest://XYZ"]
| timechart ...

EDIT: I just thought of something much simpler:

index=... sourcetype="XYZ.csv" OR sourcetype="rest://XYZ"

whrg
Motivator

I just edited my answer to include a much simpler search using "OR".

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...