Splunk Search

How to combine or join 2 sources (.csv format) with exactly the same extracted fields?

Explorer

How is it possible to combine or join 2 sources (.csv format) with excactly the same extracted fields?

source1: column1,column2,column3
source2: column1,column2,column3

In my example, the first column from each source just shows milliseconds and is absolutely equal -> column1 (source1) = column1 (source2) <- these fields I want to overlay. The values from column2 and column3 differs.

I now want to have a table in this format:
column1 column2 column2 column3 column3

Then I could compare the values from column2 with each other and the values from column3 with each other in a line chart while x-axis = column1. Also, it would be nice, if there is a y-axis for the values of column2 and another y-axis for column3, combined in one chart

Thanks in advance!!

Example in Excel

http://up.picr.de/23281724qw.jpg

0 Karma
1 Solution

Revered Legend

Try something like this

(base search temrs source=source1.csv) OR (base search temrs source=source1.csv) | table source column1 column2 column3 | chart values(*) as * by column1 source

View solution in original post

Revered Legend

Try something like this

(base search temrs source=source1.csv) OR (base search temrs source=source1.csv) | table source column1 column2 column3 | chart values(*) as * by column1 source

View solution in original post

Explorer

I did it! With your help!

(index="yourindex" source="/home/...csv") OR (index="yourindex" source="/home/...csv") | chart values(speed) by yourtimestamp source

Thank you very much

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!