topic Re: Creating a Data Table from CSV in Splunk Search

Creating a Data Table from CSV

ezajac — Fri, 07 Sep 2012 13:14:52 GMT

I am new to Splunk and only really understand the STATS Functions.

I have some CSV files that contain the fields that contain average response times for some testing that is performed monthly. ("Date", "OperationName", "Duration", "When")

This is the function I am running and each line only has one line so this kind of works for what I want to present in Splunk. Is there a better way to do this?

index="perf_results" | stats avg(Duration) as Duration by OperationName, When

What is getting returned looks like this

OperationName When Duration
Event 1 May 165
Event 1 June 168
Event 1 July 110
Event 1 August 114
Event 2 May 686
Event 2 June 885
Event 2 July 777
Event 2 August 600

What I would like is a report that presents information like this:

OperationName May June July August
Event 1 165 168 110 114
Event 2 686 885 777 600
Event 3 1000 1004 1100 1000

Re: Creating a Data Table from CSV

kristian_kolb — Fri, 07 Sep 2012 13:44:11 GMT

Try chart instead of stats;

... | chart avg(Duration) AS Duration over OperationName by When

Hope this helps,

Kristian

Re: Creating a Data Table from CSV

Drainy — Fri, 07 Sep 2012 15:22:04 GMT

Just to voice that this is the best answer, I cannot upvote it for political reasons 😉

Re: Creating a Data Table from CSV

kristian_kolb — Mon, 10 Sep 2012 07:28:41 GMT

HAHA, .conf starts today, and you've been found wanting....

Re: Creating a Data Table from CSV

Drainy — Mon, 10 Sep 2012 15:24:06 GMT

Glad to see you take your win in your stride 😄

Re: Creating a Data Table from CSV

kristian_kolb — Mon, 10 Sep 2012 18:06:36 GMT

While your soul is withering away at the slot machines, doused in cheap liquor - just think of all the fun I'll have with my Karma points.

😉