Splunk Search

How to Bind 2 events?

incognito
Explorer

Hello, 

I have the following 2 events :

1st event : 

 

 

{ [-]
   dimensionMap: { [-]
     User type: Real users
     dt.entity.application_method.name: Application
   }
   dimensions: [ [-]
     APPLICATION_METHOD
   ]
   timestamps: [ [-]
     1650966840000
     1650966900000
     1650966960000
     1650967020000
     1650967080000
     1650967140000
     1650967200000
     1650967260000
     1650967320000
     1650967380000
     1650967440000
   ]
   values: [ [-]
     0.47
     0.67
     0.37
     0.45
     0.44
     0.57
     0.48
     0.47
     0.69
     0.70
     0.40
   ]
}

 

 

2nd event : 

 

 

{ [-]
   dimensionMap: { [-]
     dt.entity.application_method.name: Application
   }
   dimensions: [ [-]
     APPLICATION_METHOD
   ]
   timestamps: [ [-]
     1650966840000
     1650966900000
     1650966960000
     1650967020000
     1650967080000
     1650967140000
     1650967200000
     1650967260000
     1650967320000
     1650967380000
     1650967440000
   ]
   values: [ [-]
     18
     27
     23
     19
     17
     21
     24
     30
     13
     10
     5
   ]
}

 

 

I would like to bind each value of the 1st event to each value of the 2nd event. I tried some join commands using the timestamps as a common value, but it didn't work.

At the end, I would like the following table (result = value1*value2) :

      Timestamp                                  Value1                    Value2                        Result

1650966840000                            0.47                          18                              0.47*18
1650966900000                            0.67                          27                              0.67*27
1650966960000                            0.37                          23                              0.37*23
1650967020000                            0.45                          19                              0.45*19
1650967080000                            0.44                          17                              0.44*17
1650967140000                            0.57                          21                              0.57*21
1650967200000                            0.48                          24                              0.48*24
1650967260000                            0.47                          30                              0.47*30
1650967320000                            0.69                          13                              0.69*13
1650967380000                            0.70                          10                              0.70*10
1650967440000                            0.40                           5                                0.40*5

Thank you.

Regards,

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...