Splunk Search

How to write search for timechart with multiple joins?

Karthikeyan
Engager

Hello,

I am trying to write a search query to fetch data from different sourcetype and the common factor in all sorucetype is _time.

I'm facing two issues.

1. With below search criteria, the value of field CPU is constant all the time, but the actual value is different.

index=indexname host=hostname sourcetype=meminfo earliest=-1d@d latest=@d
| table memUsedPct
| join type=inner _time [search index=indexname host=hostname sourcetype=cpuinfo | multikv | search CPU=all | eval CPU=100-pctIdle | table CPU]

 

2. How to show the memUsedPct and CPU in a timechart ?

Regards, Karthikeyan

Labels (4)
0 Karma

somesoni2
Revered Legend

There is no need for join. Try like this

index=indexname host=hostname (sourcetype=meminfo OR sourcetype=cpuinfo) earliest=-1d@d latest=@d
| multikv | search CPU=all OR memUsedPct=* | eval CPU=100-pctIdle
| fields _time memUsedPct CPU
| timechart avg(*) as *
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...