topic Re: I have following data in csv , how to display in chart in Splunk in Dashboards & Visualizations

I have following data in csv , how to display in chart in Splunk

rashi83 — Tue, 04 Jun 2019 14:24:36 GMT

CSV is like this
hostid compName status
x v Passed
y v Passed
z v Failed

Need to display like this in Splunk dashboard
host id CompName1 CompName2 CompName3
x status status status
y status status status

I tried using chart command but stuck how to display status with it

Re: I have following data in csv , how to display in chart in Splunk

martinpu — Tue, 04 Jun 2019 14:37:42 GMT

yourquery
|table hostid compName status

I think this should work or

|xyseries hostid compName status

|chart values(hostid) over status by compName

Re: I have following data in csv , how to display in chart in Splunk

rashi83 — Tue, 04 Jun 2019 15:14:57 GMT

Thanks !
Need one more guidance what date function can be used to get latest week events. I want to ignore past date results.

Re: I have following data in csv , how to display in chart in Splunk

martinpu — Tue, 04 Jun 2019 15:43:33 GMT

In query window, on right side choose time options - under presets use relative time and "Week to date" or "Previous week".

Re: I have following data in csv , how to display in chart in Splunk

rashi83 — Wed, 30 Sep 2020 00:48:57 GMT

I know about the time options.
We are making a dashboard - where csv will have data on a weekly basis. So while writing query for above table I want to show latest week status.

Tried using Search | eval sorttime=strptime('_time',"%m/%d/%Y %H:%M:%S%p")| sort -sorttime |dedup hostname compName +_time keepempty=true | xyseries hostname compName status

But it's showing old week data instead of latest week

Re: I have following data in csv , how to display in chart in Splunk

martinpu — Tue, 04 Jun 2019 16:15:59 GMT

Try this time modifier in beginning of search:

earliest=@w1

Shows all results from latest monday untill now

earliest=@w0

for events from latest sunday till now

earliest=-5d@w1 latest=@w6

latest business week results

Not 100% if this is what you need...

Or maybe this?

| eval thisWeekNumber=strftime(now(),"%V") 
| eval weekNoFromFile = strftime(_time, "%V")
| where thisWeekNumber=weekNoFromFile

Re: I have following data in csv , how to display in chart in Splunk

rashi83 — Tue, 04 Jun 2019 18:28:21 GMT

@martinpu thanks .
I have created a dropdown as input panel and handling time .

I also wanted to generate percentage in the same query based on status = Passed and Failed.
How do u recommend to do ?
index=x | xyseries hostname compName status | eval percentage=round((Passed/Passed+Failed)*100)

Re: I have following data in csv , how to display in chart in Splunk

martinpu — Wed, 05 Jun 2019 07:45:10 GMT

Hi @rashi83
You would have to do that via eventstats probably. Though I'd recommend doing some own investigation in how to do this as there are many examples of how to accomplish this easily available.

Please accept my answer in the original reply so this question can be resolved.