Splunk Search

Splunk 7 / Win2012r2: Retrieve Tag's Value, based on another Tag's Value & Time

htkwan
Path Finder

Hello,
I'm new to Splunk. Need some advice, I need to do as follows:
Pls. see attached, the sample.
Tag 1 = ProductionState: 0 (for 30 sec), 1 (for 90 secs), then repeat. An event is generated every 1 sec (i.e. TagAlias=ProductionState, Value=<0 or 1>)

Tag 2: WireTensionLeft: 0 (for 1 sec), 10 (for 1 sec), …, 100 (for 1 sec), then repeat. An event is generated every 1 sec (i.e. TagAlias=WireTensionLeft, Value=<0,10, ..., 100, 0,...>)

Requirement
1.Retrieve Tag1 – Value at 10 sec, 20 sec, & 75 sec, when Tag2 – Value = 1

Pls. advise. Thanks

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...