Splunk Search

How to join events for conditional statements

josefa123
Explorer

I have a DeviceA that I am monitoring. There are cpu and ram. Metrics are on different event (cpu has its own event and also RAM). how can I put it in a where clause. For example | where cpu_load < 50 and Ram <50. If I run the search with | table cpu_load RAM_load it displays two event with one value at the cpu and one value at RAM. how can I combine it in just one record or event? Thanks

0 Karma

woodcock
Esteemed Legend

You can do this (Note that it is AND, not and😞

 | where cpu_load < 50 AND Ram < 50

Also:

table cpu_load RAM_load | stats first * AS *
0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...