Getting Data In

How to make a single report from two csv files

dinkarvidyarthy
New Member
| inputlookup SF_Week41.csv 
| fields OpenedDate,ReOpenCount,LastModifiedDate,ResolvedDate,Age(Hours),CaseAge,ClosedDate,CustomerpendingTime,LastCurrentOwnerUpdateDateTime,CaseLastModifiedDate,CaseNumber,Status,OwnerL4,LastResolvedDateassubmit,CumulativeTime(L4),AssignedDateTime(L4),OwnerQueueL4,OwnerLevel,CaseOwner,IssueDefectType,IssueType,IssueSubType,AccountName | eval OpenedWeek=strftime(strptime(OpenedDate,"%m/%d/%Y"),"%V") | eval LastModifiedWeek=strftime(strptime(LastModifiedDate,"%m/%d/%Y"),"%V") | eval ClosedWeek=strftime(strptime(ClosedDate,"%m/%d/%Y"),"%V") | eval ResolvedWeek=strftime(strptime(ResolvedDate,"%m/%d/%Y"),"%V") | eval Morethan30Days = if(CaseAge>30,"Yes","No") | fields Morethan30Days CaseNumber Status OpenedDate OpenedWeek ResolvedDate ResolvedWeek LastModifiedDate LastModifiedWeek ClosedDate ClosedWeek CaseAge | where Morethan30Days="Yes" AND (Status="Customer Pending" OR Status="In Progress") | stats count by Status | addcoltotals count labelfield="Status" label="Total" | rename count as Week41

Output is:

Status                    Week41

Customer Pending          38           

In Progress               66

Total                     104

.

| inputlookup SF.csv | fields OpenedDate,ReOpenCount,LastModifiedDate,ResolvedDate,Age(Hours),CaseAge,ClosedDate,CustomerpendingTime,LastCurrentOwnerUpdateDateTime,CaseLastModifiedDate,CaseNumber,Status,OwnerL4,LastResolvedDateassubmit,CumulativeTime(L4),AssignedDateTime(L4),OwnerQueueL4,OwnerLevel,CaseOwner,IssueDefectType,IssueType,IssueSubType,AccountName | eval OpenedWeek=strftime(strptime(OpenedDate,"%m/%d/%Y"),"%V") | eval LastModifiedWeek=strftime(strptime(LastModifiedDate,"%m/%d/%Y"),"%V") | eval ClosedWeek=strftime(strptime(ClosedDate,"%m/%d/%Y"),"%V") | eval ResolvedWeek=strftime(strptime(ResolvedDate,"%m/%d/%Y"),"%V") | eval Morethan30Days = if(CaseAge>30,"Yes","No") | fields Morethan30Days CaseNumber Status OpenedDate OpenedWeek ResolvedDate ResolvedWeek LastModifiedDate LastModifiedWeek ClosedDate ClosedWeek CaseAge | where Morethan30Days="Yes" AND (Status="Customer Pending" OR Status="In Progress") | stats count by Status | addcoltotals count labelfield="Status" label="Total" | rename count as Week46

Output is:

Status                  Week46

Customer Pending        38

In Progress             62

Total                   100

Is it possible to get both of them in one report like below using append or some other command?
Expected Output :

Status                Week46                            Week41

Customer Pending      38                                38

In Progress           62                                66

Total                 100                               104
0 Karma

jpass
Contributor

you could use append to join the data together. Then run your stats after you've combined them:

| inputlookup SF_Week41.csv
| eval src="sf_week_1"
| append [|inputlookup SF.csv  | eval src="sf"]
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...