I have a lookup file with below data. This auto populates everyday from a scheduled query.
I need to send a pdf to my colleagues from a dashboard with line chart based on each feature. I tried Trellies, but 7.x version splunk donot support pdf delivery.
| inputcsv 85PercUsage.csv| stats values(feature) AS extendfeat| mvexpand extendfeat| append[| makeresults| eval extendfeat=""]| map search="search index=usage sourcetype=usedfeature=\"$extendfeat$\" earliest=-1d@d+11h+30m latest=@d+11h+30m| bin _time span=5m | stats sum(quantity) as MaxUSed by feature,_time| timechart span=5m max(MaxUSed) as LicUsed by feature" maxsearches=100