Splunk Search

extract _time from one search and apply to another

Path Finder

vmstat , net stat is captured every minute. While access_combined has entires whenever traffic comes in (every second or more).

index=os sourcetype=vmstat host="tbbpapp1.xyz.com" |multikv

and loadAvg1mi gives me avg for that minute.

I want to take the _time from the above run the following search

index=tbb sourcetype="access_combined"|rex "10\.\d+\.\d+\.\d+\s(?P<source_ip>[\d+\.+]+)\s\[\d+"

So the basic idea is to tie load times with count of source_ips to arrive at # of http connections at _time and its corresponding load on the server.


i could easily do
sourcetype=access_combined OR sourcetype=vmstat |_time , but then i felt the extractions would get more complicated than they need to be.

0 Karma

Esteemed Legend

You need the map command:

index=os sourcetype=vmstat host="tbbpapp1.xyz.com" | multikv | stats last(_time) as starttime| eval endtime=starttime+10 | map search="search earliest=$starttime$ latest=$endtime$ index=tbb sourcetype=\"access_combined\"|rex \"10\.\d+\.\d+\.\d+\s(?<source_ip>[\d+\.+]+)\s\[\d+\""
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!