Getting Data In

How do I use the columns in a CSV file to create a bar graph on a dashboard?

angshul
Path Finder

Hi, I'm new to Splunk and I'm trying to create some visualizations on a Splunk dashboard using some CSV data. My data has the following columns:
{Id, SId, Timestamp, EId, Sev}.
I need to create a bar graph with timestamp on X-axis and Sev on the Y-axis. Any help regarding this?

0 Karma

harish_l
New Member

Please use the below query,

| inputlookup myData.csv | eval _time=strftime(_time,"%m-%d-%Y %H:%M:%S.%Q") | timechart count by Sev

0 Karma

richgalloway
SplunkTrust
SplunkTrust

See if this gets you started. You'll need to replace with a time format string that matches the format of Timestamp. I've assumed 'Sev' is a numeric field. If it isn't then change 'max' to 'values'.

| inputlookup myData.csv | eval _time = strptime(Timestamp, "<format string>") | timechart max(Sev)
---
If this reply helps you, Karma would be appreciated.
0 Karma

angshul
Path Finder

@richgalloway , I'm getting the following error on running the command:

Error in 'timechart' command: The specifier 'SEV' is invalid. It must be in form (). For example: max(size).

Looks like it only accepts a function like count or max for the timechart command.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Sorry about that. Answer is corrected.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

The Payment Operations Wake-Up Call: Why Financial Institutions Can't Afford ...

The same scenario plays out across financial institutions daily. A payment system fails at 11:30 AM on a busy ...

Make Your Case: A Ready-to-Send Letter for Getting Approval to Attend .conf25

Hello Splunkers, Want to attend .conf25 in Boston this year but not sure how to convince your manager? We've ...

Community Spotlight: A Splunk Expert's Journey

In the world of data analytics, some journeys leave a lasting impact not only on the individual but on the ...