Splunk Search

How to join events for conditional statements


I have a DeviceA that I am monitoring. There are cpu and ram. Metrics are on different event (cpu has its own event and also RAM). how can I put it in a where clause. For example | where cpu_load < 50 and Ram <50. If I run the search with | table cpu_load RAM_load it displays two event with one value at the cpu and one value at RAM. how can I combine it in just one record or event? Thanks

0 Karma

Esteemed Legend

You can do this (Note that it is AND, not and😞

 | where cpu_load < 50 AND Ram < 50


table cpu_load RAM_load | stats first * AS *
0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...