Hi,
My issue is I have two different searches,
first: index=test user=test document=*
second: index=test2 user=test src=home action=view
What I would like to do is gather the timestamps from the first search and add them as a condition for the second search. I would also like to shorten the timestamp to the current hour so I can get the view actions that happen before and after there was a document value.
Is there any way of doing this in Splunk?
Take a look at this question and answer that shows how to use the map
command to use times from one search in another search:
https://answers.splunk.com/answers/232781/find-all-events-of-type-x-that-do-not-have-an-even.html
Have you looked at the map
command? That may be what you are looking for.
Youll need a main search where you rename _time to another field using eval, and then you'll pass that field to either a subsearch or appendcols, etc to bring in the data where _time is greater than the new datetimestamp you created in the main search.
something like this
index=test user=test document=* | eval firstDate=_time | eval lastDate=_time+86400 | table firstDate, lastDate | appendcols [search index=test2 user=test src=home action=view | where lastDate < _time > firstDate | table fieldNames]
maybe break the where into two where statements so you can do the greater than this less than that.
Thank you for all your help!
I still cant seem to get it right, but I did notice that Both indexes have the same date_month, date_mday and date_year fields, is there any way that i could use these fields with the Where command?
i.e index=test user=test document=* <-- should return all event where there is a document--> | table date_mday date_year document
and then run a sub search on
index=test2 user=test src=home action=view |where date_mday =date_mday(1) |where date_year = date_year(1) | table user otherindexspecfields
Thanks!