Hello,
I have a CSV dataset with 2 colomns (_time , temperature) but when i import the dataset in Splunk to do a visualization of the dataset, Splunk plot the dataset with the temperature as the X value and the time as a Y value. How can I change the two columns?
I tried to modify directly the CSV file but doesn't change anything.
Thanks
Just select time range as All time on top right. It is now showing last 24 hour. That is why you don't see events.
Please try with "All time". Because your dataset has timestamps with year 2010.
Sorry i'm new with Splunk and i don't where i have to type "all time"
Hi @nathanboon,
I see a warning on your screenshot top-left stating that _time should be UNIX time. I think your CSV timestamps are not epoc. Can you please change the search like below;
| inputcsv dataset.csv
| eval _time=strptime(_time,"%Y-%m-%d %H:%M")
| table _time temperature
I change the command but now Splunk doesn't recognize the dataset anymore
Have you tried using the table command to specify the field order?
| inputcsv dataset.csv | table _time temperature
Yes i tried this and it's works , the visualization is good however when i'm trying to apply a filter kalman, it doesn't show anything:
The instructions at https://docs.splunk.com/Documentation/MLApp/5.2.1/User/FTSExperiment#Assistant_workflow say to specify a Period. Have you tried that?
I specify the period of 1 year (365) but the result is the same.
I tried many different configuration but Splunk doesn't plot anything.