https://community.splunk.com/t5/Splunk-Search/Combine-inputcsv-and-search-to-create-a-gauge/m-p/112934#M29676 <P>I am trying to create a gauge where the green, yellow, red are dynamically adjusted using average and percentages for similar traffic over the past 30 days. The 30 day search takes a while so what I would like to do is run it overnight and dump it to a csv. I would then like to run todays numbers on the fly and apply the results (the needle in the gauge) to the csv results.</P> <P>This is where I am with it:</P> <PRE><CODE>index=msad "EventCode=4624" earliest=-1d@min |stats count as today| append[|inputcsv start=29 max=1 YsForGauge.csv] | table today average Eighty Ninety-Five </CODE></PRE> <P>This results in a table:</P> <PRE><CODE>today average Eighty Ninety-Five 892683 1255.633333 2016 2257 </CODE></PRE> <P>So the results are in two rows of the resulting table. What I would like to do is replace the table with </P> <PRE><CODE>gauge today 0 average Eighty Ninety-Five </CODE></PRE> <P>But is failing. Help?</P> Mon, 18 May 2015 15:04:02 GMT ccsfdave 2015-05-18T15:04:02Z https://community.splunk.com/t5/Splunk-Search/Combine-inputcsv-and-search-to-create-a-gauge/m-p/112934#M29676 <P>I am trying to create a gauge where the green, yellow, red are dynamically adjusted using average and percentages for similar traffic over the past 30 days. The 30 day search takes a while so what I would like to do is run it overnight and dump it to a csv. I would then like to run todays numbers on the fly and apply the results (the needle in the gauge) to the csv results.</P> <P>This is where I am with it:</P> <PRE><CODE>index=msad "EventCode=4624" earliest=-1d@min |stats count as today| append[|inputcsv start=29 max=1 YsForGauge.csv] | table today average Eighty Ninety-Five </CODE></PRE> <P>This results in a table:</P> <PRE><CODE>today average Eighty Ninety-Five 892683 1255.633333 2016 2257 </CODE></PRE> <P>So the results are in two rows of the resulting table. What I would like to do is replace the table with </P> <PRE><CODE>gauge today 0 average Eighty Ninety-Five </CODE></PRE> <P>But is failing. Help?</P> Mon, 18 May 2015 15:04:02 GMT https://community.splunk.com/t5/Splunk-Search/Combine-inputcsv-and-search-to-create-a-gauge/m-p/112934#M29676 ccsfdave 2015-05-18T15:04:02Z https://community.splunk.com/t5/Splunk-Search/Combine-inputcsv-and-search-to-create-a-gauge/m-p/112935#M29677 <P>Figured it out, not just append but appendcols puts it in one row and then gauge works!</P> <P>index=msad "EventCode=4624" earliest=-1d@min |stats count as today| <STRONG>appendcols</STRONG> [|inputcsv start=29 max=1 YsForGauge.csv] | gauge today 0 average Eighty Ninety-Five</P> Mon, 18 May 2015 15:24:33 GMT https://community.splunk.com/t5/Splunk-Search/Combine-inputcsv-and-search-to-create-a-gauge/m-p/112935#M29677 ccsfdave 2015-05-18T15:24:33Z