Splunk Search

How to Bind 2 events?

incognito
Explorer

Hello, 

I have the following 2 events :

1st event : 

 

 

{ [-]
   dimensionMap: { [-]
     User type: Real users
     dt.entity.application_method.name: Application
   }
   dimensions: [ [-]
     APPLICATION_METHOD
   ]
   timestamps: [ [-]
     1650966840000
     1650966900000
     1650966960000
     1650967020000
     1650967080000
     1650967140000
     1650967200000
     1650967260000
     1650967320000
     1650967380000
     1650967440000
   ]
   values: [ [-]
     0.47
     0.67
     0.37
     0.45
     0.44
     0.57
     0.48
     0.47
     0.69
     0.70
     0.40
   ]
}

 

 

2nd event : 

 

 

{ [-]
   dimensionMap: { [-]
     dt.entity.application_method.name: Application
   }
   dimensions: [ [-]
     APPLICATION_METHOD
   ]
   timestamps: [ [-]
     1650966840000
     1650966900000
     1650966960000
     1650967020000
     1650967080000
     1650967140000
     1650967200000
     1650967260000
     1650967320000
     1650967380000
     1650967440000
   ]
   values: [ [-]
     18
     27
     23
     19
     17
     21
     24
     30
     13
     10
     5
   ]
}

 

 

I would like to bind each value of the 1st event to each value of the 2nd event. I tried some join commands using the timestamps as a common value, but it didn't work.

At the end, I would like the following table (result = value1*value2) :

      Timestamp                                  Value1                    Value2                        Result

1650966840000                            0.47                          18                              0.47*18
1650966900000                            0.67                          27                              0.67*27
1650966960000                            0.37                          23                              0.37*23
1650967020000                            0.45                          19                              0.45*19
1650967080000                            0.44                          17                              0.44*17
1650967140000                            0.57                          21                              0.57*21
1650967200000                            0.48                          24                              0.48*24
1650967260000                            0.47                          30                              0.47*30
1650967320000                            0.69                          13                              0.69*13
1650967380000                            0.70                          10                              0.70*10
1650967440000                            0.40                           5                                0.40*5

Thank you.

Regards,

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...