Dashboards & Visualizations

From a CSV file, how do I get incoming alerts that match with location data to be displayed in a dashboard?

viji261992
Explorer

I have a "GRDB_site_list.csv" file with location details, I want to create a dashboard where the incoming alerts matching with the location should be displayed in that dashboard.

0 Karma

harsmarvania57
Ultra Champion

What are the field names do you have in raw data and column headers in lookup file ?

You can try something like this (In below query I am assuming that you location field in your raw data and you have column with name location in your lookup file.

index=yourindex | lookup GRDB_site_list.csv location AS location OUTPUT location AS l_loc | where isnotnull(l_loc) | fields - l_loc
0 Karma

viji261992
Explorer

Error in lookup command: could not find all of the specified lookup fields in the lookup table.

0 Karma

harsmarvania57
Ultra Champion

You need to change field name in lookup command based on fields you have in your raw data and CSV file

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...