Splunk Search

Can you help me visualize my input lookup file?

dinaabdelhakam
Path Finder

Hello There,

I have a file CSV as shown in the attached screenshot. I want someone to help me to draw these dates on the xaxis and the streams on yaxis and the values are shown on a secondary Y -axis alt text

0 Karma
1 Solution

whrg
Motivator

The transpose command is your friend here: It converts rows to columns.

The real difficulty lies in your date format. They are sorted lexicographically: Apr < Aug < Dec < Feb < ...

Try this out:

your base search
| transpose header_field=Streams column_name=Date
| eval Date=Date+"-01" | eval Date=strptime(Date,"%b-%y-%d") | sort Date | eval Date=strftime(Date,"%Y-%m")

This should get you something like this which can be graphed with a line chart:

Date       StreamA    StreamB    ...
2018-01    788        571        ...
2018-02    780        538        ...
...        ...        ...        ...

Apparently, using strptime() without the day does not work. So I added "-01" to the date.

View solution in original post

0 Karma

whrg
Motivator

The transpose command is your friend here: It converts rows to columns.

The real difficulty lies in your date format. They are sorted lexicographically: Apr < Aug < Dec < Feb < ...

Try this out:

your base search
| transpose header_field=Streams column_name=Date
| eval Date=Date+"-01" | eval Date=strptime(Date,"%b-%y-%d") | sort Date | eval Date=strftime(Date,"%Y-%m")

This should get you something like this which can be graphed with a line chart:

Date       StreamA    StreamB    ...
2018-01    788        571        ...
2018-02    780        538        ...
...        ...        ...        ...

Apparently, using strptime() without the day does not work. So I added "-01" to the date.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...