Hi, I'm new to splunk 🙂
This is my query:
* Tagname="series" Wert="54" | JOIN _time [SEARCH Tagname="workload" ] | CHART VALUES(Wert) BY _time *
The query above got me nearly 75% of my events. But sometimes the timestamp differs a little bit, so I need to have a tolerance range with +/- 3 seconds for "_time" .
How can I achieve this?
Thanks for your help,
Could it be the same situation that this one : to pick one event, then run a second search to find the events "around" that event.
That goes in the right direction - However it does not fully complete my needs, because it is filtering on a fix amount of results and only in a certain timespan. I want to get always and the timespan should only be respective to the results found in search 1.
-> I have updated the question - I was able to get my results with a join (but not unfortunatly not all of them). Can you help here also?
it is a little unclear to me if there are 3 fields: "key" "value" and "time" which are all fields, or there are more fields such as "named" which 'series' is a value of and andl "workload" is a field
if the latter, try this search:
index=<your_index> sourcetype=<your_sourcetype> named="series" value="54" workload="*" | stats values(workload) as unique_workloads | mvexpand unique_workloads
hope it helps
Thanks for your answer adonio: I think you got me wrong workload and series are not fields...
I have updated my question and also added a SQL Pseudocode. Do you understand it better now?