Dashboards & Visualizations

create a dash board from multiple csv files by using lookup file with multiple drop down.

kk185157
New Member

Hi All

I have data in multiple csv files. I would like to create the dashboard from csv files(dynamic values) by using lookup file(static values).
The dashboard should contain daily usage of inbound and outbound traffic of each node.

first csv name :node1.csv
Time Node Name Inbound Outbound Received Bandwidth Transmit Bandwidth
1/23/2019 15:03 node1 170323.766 208175.859 20.00 Mbps 20.00 Mbps
1/23/2019 15:08 node2 58398.6836 117372.133 20.00 Mbps 20.00 Mbps

second csv name :node2.csv
Time Node Name Inbound Outbound Received Bandwidth Transmit Bandwidth
1/23/2019 15:03 Node2 133894.9 171775.438 100.00 Mbps 25.00 Mbps
1/23/2019 15:08 node2 78438.25 156584.391 100.00 Mbps 25.00 Mbps

look up file is in csv format.
lookup.csv

SNO uid start_hour end_hour receivebandwidth transmitbandwidth node location tiers threshold start_wday end_wday
1 Node1.csv 8:00 17:00 40 40 node1 US tiers1 70% 1 7
2 node2.csv 8:00 17:00 40 40 node2 Canada tiers2 70% 1 7
3 node3.csv 0:00 23:59 10 10 India tiers3 70% 1 7

I have tried the below one. but no luck.

|eval date_wday=strftime(_time,"%u")

|eval start_h=strptime(start_hour,"%H:%M")
|eval start_e=strftime(start_e,"%H:%M")
|eval end_h=strptime(end_hour,"%H:%M")
|eval end_e=strftime(end_e,"%H:%M")

|where time_custom>="start_h" AND time_custom< "end_h" AND date_wday>= "start_wday" AND date_wday<= "end_wday"
|eval Outtraffic= Outbound/1048576
|timechart span=1d MAX(Outtraffic) AS MAXOuttraffic ,values(Transmit Bandwidth) as MAXOUT-Bandwidth

I have passed the data from input.conf file like below.

[monitor:///C:/solar/*.csv]
disabled = false
host_regex = solar\(?\w+.+)
index = main
sourcetype = lookup
host = vm1

Thanks in advance.

Regards
karteek.Korrapolu

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...