topic Re: How to chart a .csv file in Splunk Search

How to chart a .csv file

gmelasecca — Thu, 03 Sep 2015 19:12:33 GMT

I have a CSV file which runs every 5 minutes and gathers data from separate data sources. A sample of what is compiled in Splunk is below. What I'm looking to do is chart the data into each of its own columns / rows, then sort the columns by whichever we choose. The main data we will need to pull from the .csv is in bold. As you can see, the columns in the script add the column names such as ''PollTime, Server Name, QueueName etc".

PollTime, Server Name, QueueName, Display Name, value
2015-09-03 15:01:27 All, All, All, All
PollTime, Server Name, QueueName, Display Name, value
2015-09-03 14:59:42 All, All, All, All
2015-09-03 14:01:26, SERVER1.main.corp.int, SERVER.C1.DG1.DGREQ, Consumer Count, 60
2015-09-03 14:01:24, SERVER2.main.corp.int, SERVER.C2.DG2.DGREQ, Consumer Count, 0
2015-09-03 14:01:23, SERVER3.main.corp.int, SERVER.C3.DG1.DGREQ, Consumer Count, 15
2015-09-03 14:01:22, SERVER4.main.corp.int, SERVER.C4.DG2.DGREQ, Consumer Count, 0

Re: How to chart a .csv file

somesoni2 — Thu, 03 Sep 2015 21:08:11 GMT

Is the data already ingested in Splunk??

Re: How to chart a .csv file

gmelasecca — Tue, 08 Sep 2015 13:40:18 GMT

Yes the data is already in splunk. above is what splunk is outputting.

Re: How to chart a .csv file

dkoops — Wed, 09 Sep 2015 14:46:02 GMT

And is each line in your example a different event? Because then you should just make a field extraction (or alternatively use rex-command in search) and use a table command to make the chart you want.

If Splunk, for some reason, throws it all in one event you might want to check the props.conf file if he is breaking events correctly.

Re: How to chart a .csv file

lcrielaa — Thu, 10 Sep 2015 07:58:37 GMT

Use multikv to separate the data and then use the new values for your chart/timechart.

index=... sourcetype=... | multikv fields PollTime, "Server Name", QueueName, "Display Name", value | timechart avg(value) by "Server Name"

You might have to tweak the above query a bit but that should get you started.