How to extract, if log1 - severity =6 then what is the severity in log2, at given point of time?

[VijayA]

Hi All, 

I'm searching 2 different logs, which contain the "Severity" as common field.

I want to extract,  if log1 - severity =6 then what is the severity in log2, at given point of time.

Severity values will be 1-6 only

Ex:

                        Log1                                 Log2

Severity       6                                           3

Kindly help on the same...

Thank you

[VijayA]

"given point of time" means

ex: on  04/04/23 10:04:05 AM if log1 S=6, what is value of S in log2 at the same time.

                          Log1       Log2

Severity        6                  3

[ITWhisperer]

So, if you have an event in log 1 at 04/04/23 10:04:05 AM, are you expecting there to be an event in log 2 at exactly the same time? Down the second, or even millisecond?

[VijayA]

Yes, Down the second, will be good

[ITWhisperer]

This may not give you what you want, but might be close to what you have asked for

| bin _time span=1s
| chart latest(severity) by _time log

[ITWhisperer]

What do you mean by "at given point of time"?

Assuming you already have the logs ingested into Splunk, there are most likely stored as a series of events. Hopefully, these events will have a timestamp which is extracted and tagged to event. Splunk can then process these events in a pipeline of events returned by a search. It is essentially processing one event at a time. In order to compare values from more than one event, they have to be brought together (often by a stats command), so that these stats events can be processed (one at a time).

How do you want to bring your events from the two logs together?

[VijayA]

Hi,

I already have logs in splunk from both log1 and log2 as events, they have timestamps as well

I do have 4 other fields in common and using JOIN to combine the fields.

but I'm unable to compare the if S=6 in Log1, what is the S value in Log2 

Please provide some comparison steps. 

[ITWhisperer]

You haven't answered the central question - what do you mean by "given point of time"?