Hi, I'm new to splunk 🙂
This is my query:
* Tagname="series" Wert="54" | JOIN _time [SEARCH Tagname="workload" ] | CHART VALUES(Wert) BY _time *
Goal:
The query above got me nearly 75% of my events. But sometimes the timestamp differs a little bit, so I need to have a tolerance range with +/- 3 seconds for "_time" .
How can I achieve this?
Thanks for your help,
Bastian
Could it be the same situation that this one : to pick one event, then run a second search to find the events "around" that event.
That goes in the right direction - However it does not fully complete my needs, because it is filtering on a fix amount of results and only in a certain timespan. I want to get always and the timespan should only be respective to the results found in search 1.
-> I have updated the question - I was able to get my results with a join (but not unfortunatly not all of them). Can you help here also?
hello there,
it is a little unclear to me if there are 3 fields: "key" "value" and "time" which are all fields, or there are more fields such as "named" which 'series' is a value of and andl "workload" is a field
if the latter, try this search: index=<your_index> sourcetype=<your_sourcetype> named="series" value="54" workload="*" | stats values(workload) as unique_workloads | mvexpand unique_workloads
hope it helps
No there are not other fields. field1="workload" and field2="series"
try searching workload=* series=* | bin span=1m _time | stats values(workload) as unique_workloads by _time
hope i understand the question ....
Thanks for your answer adonio: I think you got me wrong workload and series are not fields...
I have updated my question and also added a SQL Pseudocode. Do you understand it better now?