extract _time from one search and apply to another

[tven7]

vmstat , net stat is captured every minute. While access_combined has entires whenever traffic comes in (every second or more).

index=os sourcetype=vmstat host="tbbpapp1.xyz.com" |multikv

and loadAvg1mi gives me avg for that minute.

I want to take the _time from the above run the following search

index=tbb sourcetype="access_combined"|rex "10\.\d+\.\d+\.\d+\s(?P<source_ip>[\d+\.+]+)\s\[\d+"

So the basic idea is to tie load times with count of source_ips to arrive at # of http connections at _time and its corresponding load on the server.

Edit:

i could easily do
sourcetype=access_combined OR sourcetype=vmstat |_time , but then i felt the extractions would get more complicated than they need to be.

[woodcock]

You need the map command:

index=os sourcetype=vmstat host="tbbpapp1.xyz.com" | multikv | stats last(_time) as starttime| eval endtime=starttime+10 | map search="search earliest=$starttime$ latest=$endtime$ index=tbb sourcetype=\"access_combined\"|rex \"10\.\d+\.\d+\.\d+\s(?<source_ip>[\d+\.+]+)\s\[\d+\""