Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Join events by closest time

$
0
0

Hello, lets say I have events from two sourcetypes:

  1. time, ip, hostname
  2. time, ip, username

Now I want to match username to hostname based on the time and ip field in the following manner: ip has to be the same, time has to be the closest time (before or after). Any easy out of the box way for doing that?


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>