Dashboards & Visualizations

How to query and create a dashboard from a Dataset

dicksola
Engager

Folks, I'm new to Splunk but learning. However I've been stuck and i need help with a simple query and Dash board i think. 

1. Im able to create a simple xml query with a dashboard that list a number of users doing what from an indexed log file. Works fine. Example server.log  and query sample index=Test* "`Users`"

 2. I have one dataset csv file that contain server names and cluster that uploaded into my space.  

Now how do i combine the query and create a dashboard from my dataset file and server log. 

That will include the User info in the indexed server logs and include the server and cluster info in the dataset csv file. 

Please advice

 

Labels (1)
0 Karma

kiran_panchavat
Influencer

@dicksola Hello, You can combine both the queries and create one single dashboard. Use lookup and map to add your CSV dataset to Splunk fields.

You may view the fields and values of your dataset in Splunk after uploading the CSV file. You can now write your query 2 using the |inputlookup or |lookup commands. Subsearch or the append command can then be used to combine your query 2 with your query 1 (index=test* "users").  

https://docs.splunk.com/Documentation/Splunk/9.2.0/SearchReference/Append 

https://docs.splunk.com/Documentation/Splunk/9.2.0/SearchReference/Lookup 

https://docs.splunk.com/Documentation/Splunk/9.2.0/Knowledge/Aboutlookupsandfieldactions 

 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...