Splunk Search

How to Bind 2 events?

incognito
Explorer

Hello, 

I have the following 2 events :

1st event : 

 

 

{ [-]
   dimensionMap: { [-]
     User type: Real users
     dt.entity.application_method.name: Application
   }
   dimensions: [ [-]
     APPLICATION_METHOD
   ]
   timestamps: [ [-]
     1650966840000
     1650966900000
     1650966960000
     1650967020000
     1650967080000
     1650967140000
     1650967200000
     1650967260000
     1650967320000
     1650967380000
     1650967440000
   ]
   values: [ [-]
     0.47
     0.67
     0.37
     0.45
     0.44
     0.57
     0.48
     0.47
     0.69
     0.70
     0.40
   ]
}

 

 

2nd event : 

 

 

{ [-]
   dimensionMap: { [-]
     dt.entity.application_method.name: Application
   }
   dimensions: [ [-]
     APPLICATION_METHOD
   ]
   timestamps: [ [-]
     1650966840000
     1650966900000
     1650966960000
     1650967020000
     1650967080000
     1650967140000
     1650967200000
     1650967260000
     1650967320000
     1650967380000
     1650967440000
   ]
   values: [ [-]
     18
     27
     23
     19
     17
     21
     24
     30
     13
     10
     5
   ]
}

 

 

I would like to bind each value of the 1st event to each value of the 2nd event. I tried some join commands using the timestamps as a common value, but it didn't work.

At the end, I would like the following table (result = value1*value2) :

      Timestamp                                  Value1                    Value2                        Result

1650966840000                            0.47                          18                              0.47*18
1650966900000                            0.67                          27                              0.67*27
1650966960000                            0.37                          23                              0.37*23
1650967020000                            0.45                          19                              0.45*19
1650967080000                            0.44                          17                              0.44*17
1650967140000                            0.57                          21                              0.57*21
1650967200000                            0.48                          24                              0.48*24
1650967260000                            0.47                          30                              0.47*30
1650967320000                            0.69                          13                              0.69*13
1650967380000                            0.70                          10                              0.70*10
1650967440000                            0.40                           5                                0.40*5

Thank you.

Regards,

Labels (3)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...