Index 1 event with text "log-off" in the event event with text log-on" in the event event with field A, field B. event with field B, field C event with "log-off" in the event event with "log-on" in the event index 2 event with field A and field D Search I need to join the events to get an event with fields A, B C & D and which returns logon and logoff time. The events occur within 1 minute of each other. I have tried to start off with something like.. index=1 A AND B AND C "log-on" AND "lof-off" | transaction A [search index=2 A AND D] | startswith "log-on"endswith "log-off" How can I add iD into the search? thanks ... View more

I have extracted an event time as a field from an event as Nov 27, 2014 9:42 presently I have: convert timeformat="%m/%d/%Y %H:%M:%S" ctime(_time) AS start_time But for some reason, splunk occasional reads the event time stamp 8 hours out, so I have extracted Nov 27, 2014 9:42, question is how can I get it as start_time thanks ... View more

Hi, I have two lookup tables created by a search with outputlookup command ,as: table_1.csv with fields _time, A,B table_2.csv with fields _time, A,C I can use [|inputlookup table_1 ] and call the csv file ok. I need to somehow join the two tables to get _time, A,B,C NOTE: the common field in A One fly in the ointment is that field A is not exclusive, by that I mean that it appears more than once in both tables, but within 30 seconds in both tables. So the time I need it to join is within A appearing within a 30s span of each other. I need to join to be as one event (one line on the outputed csv file) Then output to csv for a report which is scheduled daily. thanks ... View more

I have two indexes that I have successfully joined, they are indexA and indexB. There is a field in the resulting (joined) event FieldC. I have another index, indexY with FieldD. I need to join this indexY to indexA and indexB. This works ok. index=indexA FieldC | join FieldC [search index=indexB FeildC] | join FeildD [search index=indexY FeildD] | table _time, FeildC, FieldD now the tricky bit, I have indexE which has a start and finish event. How do I run the double join, between the two time events (Logon and logoff) in index E. ... View more