About BOstermeier

BOstermeier · ‎02-22-2018

That goes in the right direction - However it does not fully complete my needs, because it is filtering on a fix amount of results and only in a certain timespan. I want to get always and the timespan should only be respective to the results found in search 1. -> I have updated the question - I was able to get my results with a join (but not unfortunatly not all of them). Can you help here also?

BOstermeier · ‎02-21-2018

Thanks for your answer adonio: I think you got me wrong workload and series are not fields... I have updated my question and also added a SQL Pseudocode. Do you understand it better now?

BOstermeier · ‎02-14-2018

No there are not other fields. field1="workload" and field2="series"

BOstermeier · ‎02-14-2018

Hi, I'm new to splunk 🙂 This is my query: * Tagname="series" Wert="54" | JOIN _time [SEARCH Tagname="workload" ] | CHART VALUES(Wert) BY _time * Goal: The query above got me nearly 75% of my events. But sometimes the timestamp differs a little bit, so I need to have a tolerance range with +/- 3 seconds for "_time" . How can I achieve this? Thanks for your help, Bastian

Posts	4
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎02-14-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

JOIN on "_time +- 3sec"

Re: JOIN on "_time +- 3sec"

Re: JOIN on "_time +- 3sec"

Re: JOIN on "_time +- 3sec"

JOIN on "_time +- 3sec"