topic Data manipulation. Is this feasible ? in Splunk Search

Data manipulation. Is this feasible ?

reverse — Wed, 13 Nov 2019 06:19:01 GMT

Let's say I have a CSV with 2 columns
So I have transactions count per day mentioned against the date..
Now I want to show graph where i can show on which date OR how many days it took to reach 1 million ,2 million,3 million .. so on . ..
Feasible ?

Date Count

Re: Data manipulation. Is this feasible ?

gcusello — Wed, 13 Nov 2019 09:09:41 GMT

Hi @reverse,
let me understand:

you have a lookup that contains rows with two fields: date and count,
you want a graph with on x the dates and on Y the values,
then you want to compare these values with some limits (e.g. limit1=1M and limit2=2M);

is this correct?

If this is your need you could run a search like this:

| inputlookup your_lookup.csv
| chart values(count) AS count BY date
| eval limit1=1000000, limit2=2000000

and use it in a dashboard's panel like this:

<dashboard>
  <label>test_overlay_2</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>
               | inputlookup your_lookup.csv
               | chart values(count) AS count BY date
               | eval limit1=1000000, limit2=2000000
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.overlayFields">limit1,limit2</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
</dashboard>

Ciao.
Giuseppe

Re: Data manipulation. Is this feasible ?

reverse — Wed, 13 Nov 2019 14:39:36 GMT

I have below CSV ..

I want to identify how many days it took to reach 1st million .. 2nd million .. so on ..

Date Transactions Net Count
5/1/2019 0
5/2/2019 0
5/3/2019 0
5/4/2019 0
5/5/2019 0
5/6/2019 0
5/7/2019 0
5/8/2019 136
5/9/2019 62344
5/10/2019 118776
5/11/2019 119394
5/12/2019 124998
5/13/2019 255242
5/14/2019 407902
5/15/2019 545374
5/16/2019 693342
5/17/2019 823672
5/18/2019 824987
5/19/2019 825994
5/20/2019 963299
5/21/2019 1128368
5/22/2019 1273399
5/23/2019 1409096
5/24/2019 1548648
5/25/2019 1549038
5/26/2019 1549241
5/27/2019 1549437
5/28/2019 1703438
5/29/2019 1863571
5/30/2019 2023886
5/31/2019 2169741
6/1/2019 2171281
6/2/2019 2172752
6/3/2019 2357376
6/4/2019 2549456
6/5/2019 2748790
6/6/2019 2925480
6/7/2019 3094447
6/8/2019 3094937
6/9/2019 3096621
6/10/2019 3302982
6/11/2019 3530454
6/12/2019 3743284
6/13/2019 3957966
6/14/2019 4134705
6/15/2019 4135043
6/16/2019 4138509
6/17/2019 4356140
6/18/2019 4581721
6/19/2019 4807367
6/20/2019 5028887
6/21/2019 5250289
6/22/2019 5252730
6/23/2019 5265504
6/24/2019 5542090
6/25/2019 5801049
6/26/2019 6087436
6/27/2019 6341174
6/28/2019 6584475
6/29/2019 6584590
6/30/2019 6584640
7/1/2019 6720785
7/2/2019 6855255
7/3/2019 7116670
7/4/2019 7121355
7/5/2019 7362331
7/6/2019 7364580
7/7/2019 7365988
7/8/2019 7636042
7/9/2019 7920961
7/10/2019 8203068
7/11/2019 8485787
7/12/2019 8727653
7/13/2019 8792477
7/14/2019 8795300
7/15/2019 9087292
7/16/2019 9375926
7/17/2019 9662508
7/18/2019 9952211
7/19/2019 10212747
7/20/2019 10212864
7/21/2019 10216125
7/22/2019 10518348
7/23/2019 10835836
7/24/2019 11158939
7/25/2019 11465130
7/26/2019 11740613
7/27/2019 11741652
7/28/2019 11744143
7/29/2019 12051891
7/30/2019 12369031
7/31/2019 12668196
8/1/2019 12977702
8/2/2019 13265981
8/3/2019 13351765
8/4/2019 13355804
8/5/2019 13677489
8/6/2019 14019882
8/7/2019 14332307
8/8/2019 14648741
8/9/2019 14949548
8/10/2019 14975147
8/11/2019 14979884
8/12/2019 15317020
8/13/2019 15653665
8/14/2019 15959909
8/15/2019 16286073
8/16/2019 16586463
8/17/2019 16588907
8/18/2019 16595103
8/19/2019 16942456
8/20/2019 17278620
8/21/2019 17615380
8/22/2019 18022197
8/23/2019 18346390
8/24/2019 18352398
8/25/2019 18355892
8/26/2019 18721763
8/27/2019 19090736
8/28/2019 19454931
8/29/2019 19808846
8/30/2019 20110190
8/31/2019 20110193
9/1/2019 20111165
9/2/2019 20147008
9/3/2019 20492737
9/4/2019 20819653
9/5/2019 21157604
9/6/2019 21496360
9/7/2019 21496364
9/8/2019 21502498
9/9/2019 21866897
9/10/2019 22233207
9/11/2019 22561647
9/12/2019 22900983
9/13/2019 23210343
9/14/2019 23227905
9/15/2019 23231311
9/16/2019 23598761
9/17/2019 23953395
9/18/2019 24279978
9/19/2019 24670278
9/20/2019 24968218
9/21/2019 25002016
9/22/2019 25002233
9/23/2019 25362739
9/24/2019 25557055
9/25/2019 25909864
9/26/2019 26253312
9/27/2019 26551231
9/28/2019 26551261
9/29/2019 26551477
9/30/2019 26951729
10/1/2019 27409916
10/2/2019 27831962
10/3/2019 28257589
10/4/2019 28665147
10/5/2019 28665371
10/6/2019 28665585
10/7/2019 29150528
10/8/2019 29628877
10/9/2019 30086053
10/10/2019 30535860
10/11/2019 30937292
10/12/2019 31027756
10/13/2019 31027953
10/14/2019 31244053
10/15/2019 31707531
10/16/2019 32210767
10/17/2019 32698435
10/18/2019 33152677
10/19/2019 33167537
10/20/2019 33168426
10/21/2019 33689438
10/22/2019 34237851
10/23/2019 34806248
10/24/2019 35459885
10/25/2019 36047463
10/26/2019 36201224
10/27/2019 36201975
10/28/2019 36823376
10/29/2019 37464217
10/30/2019 38088407
10/31/2019 38688976
11/1/2019 39262023
11/2/2019 39262122
11/2/2019 39262221
11/3/2019 39263013
11/4/2019 39888012
11/5/2019 40086915
11/6/2019 40712066
11/7/2019 41361170
11/8/2019 41966551
11/9/2019 42061220
11/10/2019 42062234
11/11/2019 42303351
11/12/2019 42937628