Splunk Search

How to write search for timechart with multiple joins?



I am trying to write a search query to fetch data from different sourcetype and the common factor in all sorucetype is _time.

I'm facing two issues.

1. With below search criteria, the value of field CPU is constant all the time, but the actual value is different.

index=indexname host=hostname sourcetype=meminfo earliest=-1d@d latest=@d
| table memUsedPct
| join type=inner _time [search index=indexname host=hostname sourcetype=cpuinfo | multikv | search CPU=all | eval CPU=100-pctIdle | table CPU]


2. How to show the memUsedPct and CPU in a timechart ?

Regards, Karthikeyan

Labels (4)
0 Karma

Revered Legend

There is no need for join. Try like this

index=indexname host=hostname (sourcetype=meminfo OR sourcetype=cpuinfo) earliest=-1d@d latest=@d
| multikv | search CPU=all OR memUsedPct=* | eval CPU=100-pctIdle
| fields _time memUsedPct CPU
| timechart avg(*) as *
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...