I'm pretty new to this so if this is a newbie question I apologize.
I'm doing a search against a set of log files (i.e. xyz.log). Each event, or record, contains an operation id and a timestamp(down to millisecond), among other things. So, I need no more in the search, UNLESS, the operation is MOVE. If the operation is MOVE, then I need to search for events in another log (abc.log) that have nearly the same time stamp, say, within 500 milliseconds, and display as well.
asked 26 May '11, 13:24
Sounds like a pattern that could be accomplished with
This would work best if there was some common value (other than time) linking the MOVE event to the abc.log events.
answered 26 May '11, 15:57
You can use subsearch. It is extremely common, but also not the most intuitive to write:
There's no need for an
A search like this is featured on the Splunk Mug, the "What were you doing around the time of the murders?" query.
answered 26 May '11, 17:12