Splunk Search

How to Bind 2 events?

incognito
Explorer

Hello, 

I have the following 2 events :

1st event : 

 

 

{ [-]
   dimensionMap: { [-]
     User type: Real users
     dt.entity.application_method.name: Application
   }
   dimensions: [ [-]
     APPLICATION_METHOD
   ]
   timestamps: [ [-]
     1650966840000
     1650966900000
     1650966960000
     1650967020000
     1650967080000
     1650967140000
     1650967200000
     1650967260000
     1650967320000
     1650967380000
     1650967440000
   ]
   values: [ [-]
     0.47
     0.67
     0.37
     0.45
     0.44
     0.57
     0.48
     0.47
     0.69
     0.70
     0.40
   ]
}

 

 

2nd event : 

 

 

{ [-]
   dimensionMap: { [-]
     dt.entity.application_method.name: Application
   }
   dimensions: [ [-]
     APPLICATION_METHOD
   ]
   timestamps: [ [-]
     1650966840000
     1650966900000
     1650966960000
     1650967020000
     1650967080000
     1650967140000
     1650967200000
     1650967260000
     1650967320000
     1650967380000
     1650967440000
   ]
   values: [ [-]
     18
     27
     23
     19
     17
     21
     24
     30
     13
     10
     5
   ]
}

 

 

I would like to bind each value of the 1st event to each value of the 2nd event. I tried some join commands using the timestamps as a common value, but it didn't work.

At the end, I would like the following table (result = value1*value2) :

      Timestamp                                  Value1                    Value2                        Result

1650966840000                            0.47                          18                              0.47*18
1650966900000                            0.67                          27                              0.67*27
1650966960000                            0.37                          23                              0.37*23
1650967020000                            0.45                          19                              0.45*19
1650967080000                            0.44                          17                              0.44*17
1650967140000                            0.57                          21                              0.57*21
1650967200000                            0.48                          24                              0.48*24
1650967260000                            0.47                          30                              0.47*30
1650967320000                            0.69                          13                              0.69*13
1650967380000                            0.70                          10                              0.70*10
1650967440000                            0.40                           5                                0.40*5

Thank you.

Regards,

Labels (3)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Another quarter, another wave of innovation. From complex integrations to pushing the limits ...

Federated Search for Dynamic Data Self Storage Is Now Generally Available on Splunk ...

 Splunk is excited to announce the General Availability of Federated Search for Dynamic Data Self Storage ...

Index This | What has many keys but can’t unlock a door?

July 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...