csv with same fields

[bertjan]

Hi folks,

I have a question about searching in a csv file and creating graphs from it..

i have a file with the fields below but i'm

Time,CPU %,Data %,Ctrl,Serial,CPU %,Data %,Ctrl,Serial,Node
29/Apr/2013 00:00:02,11,10,1111,FJS34F30VS1111,7,6,2222,GJS88F40SV2222,HOST01
29/Apr/2013 00:00:23,9,8,1111,FJS34F30VS1111,12,11,2222,GJS88F40SV2222,HOST01
29/Apr/2013 00:00:42,11,10,1111,FJS34F30VS1111,13,13,2222,GJS88F40SV2222,HOST01
29/Apr/2013 00:01:03,10,9,1111,FJS34F30VS1111,12,11,2222,GJS88F40SV2222,HOST01

I created a query to search and create a graph for two Ctrl's CPU load from HOST01 but i'm only getting the data from the first Ctrl and not the second..
host="HOST01" | timechart dc(CPU__) by Ctlr

Any ideas how to combine this two Ctlr into 1 graph or do i have to do something with lookups?

regards, BK

[ngatchasandra]

Hi

• When I index your file and run your request, it displays me the good results because indexing allow me to see all values of fields CPU% and Ctrl then, all 6 values of CPU in one column CPU and all 2 values of Ctrl in one column Ctrl.
• When I work it directly in csv file without indexing, in encounter the same problem like you.

I can conclude that, among these same fields in the csv file, when we work with lookup, its only first field that is considers.

You have two cases to resolve that:

1- Index the file before start searching
2- Or modify your CSV file the way to put all values of CPU% and Ctrl in the same field

with 1, i get the result like follow:

            20 Per Page Format Preview Prev 1 2 3 4 Next
            _time               1111    2222
            2013-04-29 00:00:02 2   2
            2013-04-29 00:00:03 0   0
            2013-04-29 00:00:04 0   0
            2013-04-29 00:00:05 0   0
            2013-04-29 00:00:06 0   0
            2013-04-29 00:00:07 0   0
            2013-04-29 00:00:08 0   0
            2013-04-29 00:00:09 0   0
            2013-04-29 00:00:10 0   0
            2013-04-29 00:00:11 0   0
            2013-04-29 00:00:12 0   0
            2013-04-29 00:00:13 0   0
            2013-04-29 00:00:14 0   0
            2013-04-29 00:00:15 0   0
            2013-04-29 00:00:16 0   0
            2013-04-29 00:00:17 0   0
            2013-04-29 00:00:18 0   0
            2013-04-29 00:00:19 0   0
            2013-04-29 00:00:20 0   0
            2013-04-29 00:00:21 0