Hi,
Looking for tips/hints on the best way to extract a value from a sub-search, including the timestamp that the is associated with the value, and perform a search in another index for that value within a fuzzy-ish range around that same timestamp.
Scenario is this:
index foo has an IP address and a time and date.
index bar ALSO has IP address, time and date, but contains additional values, such as OS
In meta-search syntax, I'd like to do:
index=bar fuzzyrange=2hr [ search index=foo ip=1.2.3.4 | return ip,timestamp ]
And I'd like Splunk to magically take the timestamp from the subsearch and look for the same IP in the bar index, but with a two hour variation on that timestamp.
Is there an easy way?
It sounds very much like you could benefit from using the localize
command. The docs explain the concept pretty well so I'll just link you there: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Localize