How to query and create a dashboard from a Dataset

[dicksola]

Folks, I'm new to Splunk but learning. However I've been stuck and i need help with a simple query and Dash board i think. 

1. Im able to create a simple xml query with a dashboard that list a number of users doing what from an indexed log file. Works fine. Example server.log  and query sample index=Test* "`Users`"

 2. I have one dataset csv file that contain server names and cluster that uploaded into my space.  

Now how do i combine the query and create a dashboard from my dataset file and server log. 

That will include the User info in the indexed server logs and include the server and cluster info in the dataset csv file. 

Please advice

[kiran_panchavat]

@dicksola Hello, You can combine both the queries and create one single dashboard. Use lookup and map to add your CSV dataset to Splunk fields.

You may view the fields and values of your dataset in Splunk after uploading the CSV file. You can now write your query 2 using the |inputlookup or |lookup commands. Subsearch or the append command can then be used to combine your query 2 with your query 1 (index=test* "users").  

https://docs.splunk.com/Documentation/Splunk/9.2.0/SearchReference/Append 

https://docs.splunk.com/Documentation/Splunk/9.2.0/SearchReference/Lookup 

https://docs.splunk.com/Documentation/Splunk/9.2.0/Knowledge/Aboutlookupsandfieldactions