Timechart based on two joined indexes

[kp_pl]

I have a set of data which comes from two indexes . It looks more or less like below:

(index="o_a_p") OR ( index="o_d_p" )
```a ```
| eval ca = substr(c_u,2,length(c_u))    ``` transformation of oap index``
```d ```
| eval e_d = mvindex(split(ed, ","), 0)  ``` transformation of odp index```
| eval cd = mvindex(split(Rr, "/") ,0)
| eval AAA=c_e.":".ca
| eval DDD=e_d.":".cd
| eval join=if(index="o_a_p",AAA,DDD)  ``` join field```
| stats dc(index) AS count_index values(Op) as OP values(t_t) as TT BY join
| where count_index=2

so now , how to create timechart based on fields which comes from stats ? There is no _time field there 😞

K.

[gcusello · Accepted solution]

Hi @kp_pl ,

as @ITWhisperer said, you must include -time in the stats command, so you can use it in timechart:

(index="o_a_p") OR ( index="o_d_p" )
| eval ca = substr(c_u,2,length(c_u))    ``` transformation of oap index``
| eval e_d = mvindex(split(ed, ","), 0)  ``` transformation of odp index```
| eval cd = mvindex(split(Rr, "/") ,0)
| eval AAA=c_e.":".ca
| eval DDD=e_d.":".cd
| eval join=if(index="o_a_p",AAA,DDD)  ``` join field```
| stats 
     dc(index) AS count_index 
     values(Op) AS OP 
     values(t_t) AS TT 
     earliest(_time) AS _time
     BY join
| where count_index=2
| timechart count

Ciao.

Giuseppe

[ITWhisperer]

You need to include _time in your by clause of the stats, perhaps doing a bin command on it first to put it into buckets. It might be more profitable if you describe what it is you are trying to achieve (in non-Splunk terms), and provide some sample (anonymised) representative events, and an example of your expected output.

[kp_pl]

well, my question concerned general idea of using timechart when joining indexes.  Not ready to prepare ready to analyze example.
Anyway your hint was valuable as well . Especially  using BIN command and baskets could be very useful in my queries .  I am going to read more about it and I guess will ask more question about BIN  soon 🙂

thank you @ITWhisperer