Dashboards & Visualizations

create a dash board from multiple csv files by using lookup file with multiple drop down.

kk185157
New Member

Hi All

I have data in multiple csv files. I would like to create the dashboard from csv files(dynamic values) by using lookup file(static values).
The dashboard should contain daily usage of inbound and outbound traffic of each node.

first csv name :node1.csv
Time Node Name Inbound Outbound Received Bandwidth Transmit Bandwidth
1/23/2019 15:03 node1 170323.766 208175.859 20.00 Mbps 20.00 Mbps
1/23/2019 15:08 node2 58398.6836 117372.133 20.00 Mbps 20.00 Mbps

second csv name :node2.csv
Time Node Name Inbound Outbound Received Bandwidth Transmit Bandwidth
1/23/2019 15:03 Node2 133894.9 171775.438 100.00 Mbps 25.00 Mbps
1/23/2019 15:08 node2 78438.25 156584.391 100.00 Mbps 25.00 Mbps

look up file is in csv format.
lookup.csv

SNO uid start_hour end_hour receivebandwidth transmitbandwidth node location tiers threshold start_wday end_wday
1 Node1.csv 8:00 17:00 40 40 node1 US tiers1 70% 1 7
2 node2.csv 8:00 17:00 40 40 node2 Canada tiers2 70% 1 7
3 node3.csv 0:00 23:59 10 10 India tiers3 70% 1 7

I have tried the below one. but no luck.

|eval date_wday=strftime(_time,"%u")

|eval start_h=strptime(start_hour,"%H:%M")
|eval start_e=strftime(start_e,"%H:%M")
|eval end_h=strptime(end_hour,"%H:%M")
|eval end_e=strftime(end_e,"%H:%M")

|where time_custom>="start_h" AND time_custom< "end_h" AND date_wday>= "start_wday" AND date_wday<= "end_wday"
|eval Outtraffic= Outbound/1048576
|timechart span=1d MAX(Outtraffic) AS MAXOuttraffic ,values(Transmit Bandwidth) as MAXOUT-Bandwidth

I have passed the data from input.conf file like below.

[monitor:///C:/solar/*.csv]
disabled = false
host_regex = solar\(?\w+.+)
index = main
sourcetype = lookup
host = vm1

Thanks in advance.

Regards
karteek.Korrapolu

Tags (1)
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...