Dashboards & Visualizations

create a dash board from multiple csv files by using lookup file with multiple drop down.

kk185157
New Member

Hi All

I have data in multiple csv files. I would like to create the dashboard from csv files(dynamic values) by using lookup file(static values).
The dashboard should contain daily usage of inbound and outbound traffic of each node.

first csv name :node1.csv
Time Node Name Inbound Outbound Received Bandwidth Transmit Bandwidth
1/23/2019 15:03 node1 170323.766 208175.859 20.00 Mbps 20.00 Mbps
1/23/2019 15:08 node2 58398.6836 117372.133 20.00 Mbps 20.00 Mbps

second csv name :node2.csv
Time Node Name Inbound Outbound Received Bandwidth Transmit Bandwidth
1/23/2019 15:03 Node2 133894.9 171775.438 100.00 Mbps 25.00 Mbps
1/23/2019 15:08 node2 78438.25 156584.391 100.00 Mbps 25.00 Mbps

look up file is in csv format.
lookup.csv

SNO uid start_hour end_hour receivebandwidth transmitbandwidth node location tiers threshold start_wday end_wday
1 Node1.csv 8:00 17:00 40 40 node1 US tiers1 70% 1 7
2 node2.csv 8:00 17:00 40 40 node2 Canada tiers2 70% 1 7
3 node3.csv 0:00 23:59 10 10 India tiers3 70% 1 7

I have tried the below one. but no luck.

|eval date_wday=strftime(_time,"%u")

|eval start_h=strptime(start_hour,"%H:%M")
|eval start_e=strftime(start_e,"%H:%M")
|eval end_h=strptime(end_hour,"%H:%M")
|eval end_e=strftime(end_e,"%H:%M")

|where time_custom>="start_h" AND time_custom< "end_h" AND date_wday>= "start_wday" AND date_wday<= "end_wday"
|eval Outtraffic= Outbound/1048576
|timechart span=1d MAX(Outtraffic) AS MAXOuttraffic ,values(Transmit Bandwidth) as MAXOUT-Bandwidth

I have passed the data from input.conf file like below.

[monitor:///C:/solar/*.csv]
disabled = false
host_regex = solar\(?\w+.+)
index = main
sourcetype = lookup
host = vm1

Thanks in advance.

Regards
karteek.Korrapolu

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...