Hi Splunkers,
I’m working on a Dashboard panel where I have to create a monthly wise data as shown in the screenshot.
I have a field called “age group” and corresponding month’s data. But every month’s data comes from an external lookup file.
Data for example:
Age Group Sept July Jun
30-90 235 0 34
90-180 1757 2168 3467
180+ 19374 20,534 12,661
I’m using this below code but it’s not actually working for me. Please help me with the logic to produce the chart like as it was in the screenshot. TIA
|inputlookup september.csv
|stats count by "Age Group"
|eval _time=strptime("2022-09-01","%Y-%m-%d")
|append [|inputlookup july.csv
|stats count by "Age Group"
|eval _time=strptime("2022-07-01","%Y-%m-%d")]
…
|chart count by _time, “Age Group”
OK, it sounds like your actual data already has the counts in?
This means that your example search would also have returned 1's
Try summing the counts (assuming the count column in your csv is called "count")
|inputlookup september.csv
|eval _time=strptime("2022-09-01","%Y-%m-%d")
|append [|inputlookup july.csv
|eval _time=strptime("2022-07-01","%Y-%m-%d")]
| chart sum(count) by _time "Age Group"
It is often helpful and less time-consuming if you provide as much information about your problem as possible so we are not left guessing and end up providing incorrect solutions based on false assumptions.
There are mixed messages in your requirement - the example table you have shown gives the first column as age groups with dates as the subsequent columns, whereas the SPL and the screenshot would be give the first column as dates and subsequent columns as age groups.
For the first table, try this:
|inputlookup september.csv
|eval _time=strptime("2022-09-01","%Y-%m-%d")
|append [|inputlookup july.csv
|eval _time=strptime("2022-07-01","%Y-%m-%d")]
| chart count by "Age Group" _time
For the screenshot, try this:
|inputlookup september.csv
|eval _time=strptime("2022-09-01","%Y-%m-%d")
|append [|inputlookup july.csv
|eval _time=strptime("2022-07-01","%Y-%m-%d")]
| chart count by _time "Age Group"
yeah, I’m trying to achieve the screen shot. But the you’ve mentioned isn’t working unfortunately.
In what way is it not working?