Splunk Search

How to merge two searches and make a single timechart?

naty
Path Finder

Hey,

i'm trying to merge/join 2 searches into 1, and create a table of the data.

this is my starting query:

index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla | join type=left max=1 [search index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla2] | table _time,ID,field1,field2,field3,field4,field5

with this query i can get the minutely data.

what i need is an hourly data, something like timechart span=1h does.
but my problem is that i need an hourly data for every hour for fields1-5, so timechart is not good for me.
(e.g i need timechart max(avg(field1),field2,...,field5) by ID but timechart supports only one field)

i have tried using bucket like this:

index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla | join type=left max=1 [search index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla2] | bucket _time span=1h | table _time,ID,field1,field2,field3,field4,field5

but what i get is the same time for all the lines.

my wish is to have something like this:
index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla | join type=left max=1 [search index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla2] | table _time,ID,field1,field2,field3,field4,field5 | timechart avg(field1),avg(field2),avg(field3),avg(field4),avg(field5) by ID span=1h

bu again, timechart does not support multiple fields.

so my question is:
1. how to merge 2 searches into one large table?
2. how to make the span of that large table become 1h?

Thank you!!

Tags (1)
0 Karma

somesoni2
Revered Legend

How about this

index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla | join type=left max=1 [search index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla2] | table _time,ID,field1,field2,field3,field4,field5 | bucket span=1h _time 
| stats avg(*) as * by _time ID
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...