Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to join customer ID data from different sources and create a time-based report where x-axis is total time and y-axis is total events?

$
0
0
I want to correlate data from 2 sources. First data source contains store_events (**source1=store_events**) and second source contains book_events (**source2=book_events**). Source store_events contains a field called store_start_time and source book_events contains a field called store_end_time. Both sources contain a field called **customerid**. How can I join the data based on customerid and create a report with my x-axis showing total_time (store_start_time + store_end_time) and y-axis showing total events ? Any help is appreciated.

Viewing all articles
Browse latest Browse all 47296

Trending Articles