Join and a Transaction with _time within minute?

[dgshue]

Ok folks, here's a doozy.

Two sets of data, first set of data is needs to be evaluated by a transaction to group a long log together.

index="main" sourcetype=APPPERF | transaction maxspan=0s startswith="Transaction arrived:" endswith="Sent transaction" | search Transaction_Name="App Test Script" | timechart span=10m values(Duration) by Transaction_Name

From this search I can get the "Duration" that the App Test Script took.. great!

My second set of data is bandwidth related.

index=nagios | sort _time| delta inAbsolut as inabs_change| delta outAbsolut as outabs_change| where inabs_change>=0| where outabs_change>=0| eval inkilobits=(inabs_change*8/1000)| eval outkilobits=(outabs_change*8/1000)| timechart span=1m per_second(inkilobits) as in_kbps, per_second(outkilobits) as out_kbps

From this search (found on splunkbase) I am getting my firewall current bandwidth. I've been somewhat successful joining these two together by _time, but my problem with that is that my bandwidth polling and app perf polling are not in sync, so I may only get 2 or 3 records to match.

I'm open to any suggestions on how to get these two data sets into a timechart.

[martin_mueller]

If you do a timechart over the same range with the same span twice you can use appendcols to merge them.