Getting Data In

Given the attached Data File (testData.csv), add it as a lookup file and create a dashboard showing a barchart showing the total number of visits received in 2016 vs 2017

shankeranollamu
New Member

Date Visitors
Jul/14/2017 26
Jun/3/2017 34
Sep/30/2016 2
Jul/29/2017 71
Sep/9/2016 10
Jun/22/2017 40
Apr/21/2017 1
Jul/4/2017 57
Sep/24/2016 1

Tags (1)
0 Karma
1 Solution

niketn
Legend

@shankeranollamurali, you can use stats command for finding sum of visitors per year. Try the following:

| inputlookup testData.csv
| eval Year=case(match(Date,"2016$"),2016,match(Date,"2017$"),2017)
| stats sum(Visitors) as Visitors by Year

Following is the run anywhere dashboard based on sample data provided in the question:

| makeresults
| eval data="Jul/14/2017,26;Jun/3/2017,34;Sep/30/2016,2;Jul/29/2017,71;Sep/9/2016,10;Jun/22/2017,40;Apr/21/2017,1;Jul/4/2017,57;Sep/24/2016,1"
| makemv data delim=";"
| mvexpand data
| eval data=split(data,",")
| eval Date=mvindex(data,0),Visitors=mvindex(data,1)
| table Date Visitors
| eval Year=case(match(Date,"2016$"),2016,match(Date,"2017$"),2017)
| stats sum(Visitors) as Visitors by Year
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

493669
Super Champion

Go to Settings>>Lookups » Lookup table files » Add new
here upload csv file and give Destination filename as lookupname.csv
then to create dashboard
Go to Settings>>User interface » Views click on New and write your xml query and provide Destination app name

0 Karma

niketn
Legend

@shankeranollamurali, you can use stats command for finding sum of visitors per year. Try the following:

| inputlookup testData.csv
| eval Year=case(match(Date,"2016$"),2016,match(Date,"2017$"),2017)
| stats sum(Visitors) as Visitors by Year

Following is the run anywhere dashboard based on sample data provided in the question:

| makeresults
| eval data="Jul/14/2017,26;Jun/3/2017,34;Sep/30/2016,2;Jul/29/2017,71;Sep/9/2016,10;Jun/22/2017,40;Apr/21/2017,1;Jul/4/2017,57;Sep/24/2016,1"
| makemv data delim=";"
| mvexpand data
| eval data=split(data,",")
| eval Date=mvindex(data,0),Visitors=mvindex(data,1)
| table Date Visitors
| eval Year=case(match(Date,"2016$"),2016,match(Date,"2017$"),2017)
| stats sum(Visitors) as Visitors by Year
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...