Dashboards & Visualizations

Create graphs from a CSV file with time and values

athreyavc
New Member

Hi,

I am vey new to splunk, still exploring the options.

I have a file it is a CSV

03/27/2014 18:01:32, 2.036544
03/27/2014 18:11:32, 1.846386
03/27/2014 18:21:32, 1.911929
03/27/2014 18:31:32, 1.655284
03/27/2014 18:41:32, 9.481447
03/27/2014 18:51:32, 9.385653
03/27/2014 19:01:32, 9.599620
03/27/2014 19:11:37, 2.907257
03/27/2014 19:21:41, 2.192929
03/27/2014 19:31:41, 1.993718

Is it possible to create a graph using the CSV in Splunk?

Best Regards,
A

Tags (1)
0 Karma
1 Solution

linu1988
Champion

| inputlookup master.csv|eval _time=strptime(Time,"%m/%d/%Y %H:%M")|timechart avg(Value) span=5m

View solution in original post

linu1988
Champion

| inputlookup master.csv|eval _time=strptime(Time,"%m/%d/%Y %H:%M")|timechart avg(Value) span=5m

reswob4
Builder

I've been looking for something that did what Values did. Thanks.

0 Karma

athreyavc
New Member

thank you for helping me so quickly with this.It was mainly because there was readings which are 0 for some timestamps, corrected that with this.

Graph looks all good.

|inputlookup master.csv |fields Time Bandwidth | eval _time=strptime(Time,"%m/%d/%Y %H:%M") | eval _bandwidth=(Bandwidth) | timechart mode(_bandwidth) span=5m | fillnull value=0

0 Karma

linu1988
Champion

it may be missing some timestamp or it may not be able to read the formated csv file.
try the below as well
|timechart Values(Bandwidth) span=5m

0 Karma

athreyavc
New Member

One other issue I observed when I graph it it misses some values, it is becuase of Avg ?

0 Karma

somesoni2
Revered Legend

Try this:

| inputlookup master.csv | fields Time,bandwidth | convert ctime | eval bw=bandwidth/100| convert timeformat="%m/%d/%Y %H:%M" mktime(Time) as _time | table _time bw 
0 Karma

athreyavc
New Member

|inputlookup master.csv|eval _time=strptime(Time,"%m/%d/%Y %H:%M")|timechart avg(Bandwidth) span=5m

Worked like a Charm, awesome!!

0 Karma

somesoni2
Revered Legend

Where are you using this query to create chart, a dashboard or from Search screen?

0 Karma

athreyavc
New Member

thanks for the reply,

Sorry, it doesn't show the time in the X-axis, Graph is getting created and it is fine too, just want the X axis to show dates.

Thanks again

best Regards,

A

0 Karma

athreyavc
New Member

Hi,

Sorry there was a delay from myside on the update. I got the Graph created.

04/14/2014 08:05,1048576
04/14/2014 08:10,1048576
04/14/2014 08:15,908112
04/14/2014 08:20,873912
04/14/2014 08:25,1048576
04/14/2014 08:30,1048576

| inputlookup master.csv | fields Time,bandwidth | eval bw=bandwidth/100 | table Time bw,

however the X-Axis is not showing the times.

I am not sure how to use the timechart for this.

Please help.

Best Regards,

A

0 Karma

athreyavc
New Member

Hi Thanks for the comment.

Should I run it from the command line?

0 Karma

somesoni2
Revered Legend

You can add your csv file as lookup input file OR import to Splunk (with necessary field extraction configuration). Once data is in splunk, your can create charts as per your requirement.
if lookup
|inputlookup yourCsvFileName.csv | stats max(Value) by Timestamp
if imported to index
index=yourIndex source=*yourCsvFileName.csv | stats max(Value) by Timestamp

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...