Getting Data In

How to make a single report from two csv files

dinkarvidyarthy
New Member
| inputlookup SF_Week41.csv 
| fields OpenedDate,ReOpenCount,LastModifiedDate,ResolvedDate,Age(Hours),CaseAge,ClosedDate,CustomerpendingTime,LastCurrentOwnerUpdateDateTime,CaseLastModifiedDate,CaseNumber,Status,OwnerL4,LastResolvedDateassubmit,CumulativeTime(L4),AssignedDateTime(L4),OwnerQueueL4,OwnerLevel,CaseOwner,IssueDefectType,IssueType,IssueSubType,AccountName | eval OpenedWeek=strftime(strptime(OpenedDate,"%m/%d/%Y"),"%V") | eval LastModifiedWeek=strftime(strptime(LastModifiedDate,"%m/%d/%Y"),"%V") | eval ClosedWeek=strftime(strptime(ClosedDate,"%m/%d/%Y"),"%V") | eval ResolvedWeek=strftime(strptime(ResolvedDate,"%m/%d/%Y"),"%V") | eval Morethan30Days = if(CaseAge>30,"Yes","No") | fields Morethan30Days CaseNumber Status OpenedDate OpenedWeek ResolvedDate ResolvedWeek LastModifiedDate LastModifiedWeek ClosedDate ClosedWeek CaseAge | where Morethan30Days="Yes" AND (Status="Customer Pending" OR Status="In Progress") | stats count by Status | addcoltotals count labelfield="Status" label="Total" | rename count as Week41

Output is:

Status                    Week41

Customer Pending          38           

In Progress               66

Total                     104

.

| inputlookup SF.csv | fields OpenedDate,ReOpenCount,LastModifiedDate,ResolvedDate,Age(Hours),CaseAge,ClosedDate,CustomerpendingTime,LastCurrentOwnerUpdateDateTime,CaseLastModifiedDate,CaseNumber,Status,OwnerL4,LastResolvedDateassubmit,CumulativeTime(L4),AssignedDateTime(L4),OwnerQueueL4,OwnerLevel,CaseOwner,IssueDefectType,IssueType,IssueSubType,AccountName | eval OpenedWeek=strftime(strptime(OpenedDate,"%m/%d/%Y"),"%V") | eval LastModifiedWeek=strftime(strptime(LastModifiedDate,"%m/%d/%Y"),"%V") | eval ClosedWeek=strftime(strptime(ClosedDate,"%m/%d/%Y"),"%V") | eval ResolvedWeek=strftime(strptime(ResolvedDate,"%m/%d/%Y"),"%V") | eval Morethan30Days = if(CaseAge>30,"Yes","No") | fields Morethan30Days CaseNumber Status OpenedDate OpenedWeek ResolvedDate ResolvedWeek LastModifiedDate LastModifiedWeek ClosedDate ClosedWeek CaseAge | where Morethan30Days="Yes" AND (Status="Customer Pending" OR Status="In Progress") | stats count by Status | addcoltotals count labelfield="Status" label="Total" | rename count as Week46

Output is:

Status                  Week46

Customer Pending        38

In Progress             62

Total                   100

Is it possible to get both of them in one report like below using append or some other command?
Expected Output :

Status                Week46                            Week41

Customer Pending      38                                38

In Progress           62                                66

Total                 100                               104
0 Karma

jpass
Contributor

you could use append to join the data together. Then run your stats after you've combined them:

| inputlookup SF_Week41.csv
| eval src="sf_week_1"
| append [|inputlookup SF.csv  | eval src="sf"]
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...