Looking for tips/hints on the best way to extract a value from a sub-search, including the timestamp that the is associated with the value, and perform a search in another index for that value within a fuzzy-ish range around that same timestamp.
Scenario is this:
In meta-search syntax, I'd like to do:
index=bar fuzzyrange=2hr [ search index=foo ip=126.96.36.199 | return ip,timestamp ]
And I'd like Splunk to magically take the timestamp from the subsearch and look for the same IP in the bar index, but with a two hour variation on that timestamp.
Is there an easy way?
asked 06 Jun '12, 17:44
It sounds very much like you could benefit from using the
answered 06 Jun '12, 21:55