|
Hi, Looking for tips/hints on the best way to extract a value from a sub-search, including the timestamp that the is associated with the value, and perform a search in another index for that value within a fuzzy-ish range around that same timestamp. Scenario is this: In meta-search syntax, I'd like to do: index=bar fuzzyrange=2hr [ search index=foo ip=1.2.3.4 | return ip,timestamp ] And I'd like Splunk to magically take the timestamp from the subsearch and look for the same IP in the bar index, but with a two hour variation on that timestamp. Is there an easy way? |
|
It sounds very much like you could benefit from using the |
