Splunk Search

How to Bind 2 events?

incognito
Explorer

Hello, 

I have the following 2 events :

1st event : 

 

 

{ [-]
   dimensionMap: { [-]
     User type: Real users
     dt.entity.application_method.name: Application
   }
   dimensions: [ [-]
     APPLICATION_METHOD
   ]
   timestamps: [ [-]
     1650966840000
     1650966900000
     1650966960000
     1650967020000
     1650967080000
     1650967140000
     1650967200000
     1650967260000
     1650967320000
     1650967380000
     1650967440000
   ]
   values: [ [-]
     0.47
     0.67
     0.37
     0.45
     0.44
     0.57
     0.48
     0.47
     0.69
     0.70
     0.40
   ]
}

 

 

2nd event : 

 

 

{ [-]
   dimensionMap: { [-]
     dt.entity.application_method.name: Application
   }
   dimensions: [ [-]
     APPLICATION_METHOD
   ]
   timestamps: [ [-]
     1650966840000
     1650966900000
     1650966960000
     1650967020000
     1650967080000
     1650967140000
     1650967200000
     1650967260000
     1650967320000
     1650967380000
     1650967440000
   ]
   values: [ [-]
     18
     27
     23
     19
     17
     21
     24
     30
     13
     10
     5
   ]
}

 

 

I would like to bind each value of the 1st event to each value of the 2nd event. I tried some join commands using the timestamps as a common value, but it didn't work.

At the end, I would like the following table (result = value1*value2) :

      Timestamp                                  Value1                    Value2                        Result

1650966840000                            0.47                          18                              0.47*18
1650966900000                            0.67                          27                              0.67*27
1650966960000                            0.37                          23                              0.37*23
1650967020000                            0.45                          19                              0.45*19
1650967080000                            0.44                          17                              0.44*17
1650967140000                            0.57                          21                              0.57*21
1650967200000                            0.48                          24                              0.48*24
1650967260000                            0.47                          30                              0.47*30
1650967320000                            0.69                          13                              0.69*13
1650967380000                            0.70                          10                              0.70*10
1650967440000                            0.40                           5                                0.40*5

Thank you.

Regards,

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...