Importation and visualisation of CSV issue

[nathanboon]

Hello, 

I have a CSV dataset with 2 colomns (_time , temperature) but when i import the dataset in Splunk to do a visualization of the dataset, Splunk plot the dataset with the temperature as the X value and the time as a Y value. How can I change the two columns? 

I tried to modify directly the CSV file but doesn't change anything.

Thanks 

[scelikok]

Just select time range as All time on top right. It is now showing last 24 hour. That is why you don't see events.

[scelikok]

Please try with "All time". Because your dataset has timestamps with year 2010. 

[nathanboon]

Sorry i'm new with Splunk and i don't where i have to type "all time"

[scelikok]

Hi @nathanboon,

I see a warning on your screenshot top-left stating that _time should be UNIX time. I think your CSV timestamps are not epoc. Can you please change the search like below;

| inputcsv dataset.csv 
| eval _time=strptime(_time,"%Y-%m-%d %H:%M")
| table _time temperature

[nathanboon]

I change the command but now Splunk doesn't recognize the dataset anymore

[richgalloway]

Have you tried using the table command to specify the field order?

| inputcsv dataset.csv | table _time temperature

[nathanboon]

Yes i tried this and it's works , the visualization is good however when i'm trying to apply a filter kalman, it doesn't show anything:

[richgalloway]

The instructions at https://docs.splunk.com/Documentation/MLApp/5.2.1/User/FTSExperiment#Assistant_workflow say to specify a Period.  Have you tried that?

[nathanboon]

I specify the period of 1 year (365) but the result is the same.

I tried many different configuration but Splunk doesn't plot anything.