topic Re: timchart not working on lookup csv data in Splunk Search

Why is timchart not working on lookup csv data?

venky1544 — Tue, 12 Sep 2023 21:24:14 GMT

Hi All

i ahve a lookup file .csv where i have timestamp Name and USEDGB values i have been trying to run a time chart to see the total USEDGB per day Both lookup definition and lookup table file has app permissions

|inputlookup ABC_DISK_UTILIZATION.csv |eval _time=Timestamp |timechart span=24h sum(USEDGB)

the result only shows time but no values of USEDGB can you please help

Timestamp	NAME	USEDGB
12/08/2023 22:04	RECO_A	48.61
12/08/2023 13:04	RECO_B	46.21
12/08/2023 03:04	RECO_C	46133.89
11/08/2023 20:01	RECO_A	164.11
11/08/2023 18:01	RECO_B	48.61
11/08/2023 16:01	RECO_C	46.21
10/08/2023 22:00	RECO_A	45327.22
10/08/2023 17:00	RECO_B	193.4
10/08/2023 08:00	RECO_C	48.61
09/08/2023 21:00	RECO_A	46.21
09/08/2023 13:00	RECO_B	45205.72
09/08/2023 06:00	RECO_C	132.57
08/08/2023 19:00	RECO_A	48.61
08/08/2023 12:00	RECO_B	46.21
08/08/2023 10:00	RECO_C	45203.77
07/08/2023 22:00	RECO_A	132.56
07/08/2023 14:00	RECO_B	48.61
07/08/2023 07:00	RECO_C	46.21
06/08/2023 22:04	RECO_A	45199.08
06/08/2023 13:04	RECO_B	123.85
06/08/2023 03:04	RECO_C	48.61
05/08/2023 20:01	RECO_A	46.21
05/08/2023 18:01	RECO_B	45196.12
05/08/2023 16:01	RECO_C	117.4

Re: timchart not working on lookup csv data

richgalloway — Tue, 12 Sep 2023 12:11:03 GMT

The timestamp commands requires the _time field, which must be in epoch form. Convert Timestamp into _time using strptime().

|inputlookup ABC_DISK_UTILIZATION.csv |eval _time=strptime(Timestamp, "%d/%m/%Y %H:%M") |timechart span=24h sum(USEDGB)

Re: timchart not working on lookup csv data

venky1544 — Tue, 12 Sep 2023 13:03:30 GMT

Hi @richgalloway

did tried that not working 😞

Re: timchart not working on lookup csv data

ITWhisperer — Tue, 12 Sep 2023 13:48:48 GMT

There doesn't appear to be anything wrong with your search - perhaps it is your data. Please share some actual rows from your csv.