Splunk Search

How to aggregate data from CSV file in Splunk Chart?

rus7am
Explorer

Hi guys,

I have CSV file with following structure,

TicketNumber,OpenDate
1,date1
2,date1
3,date1
4,date2
5,date3
6,date3

And I need to build bars with information on how many tickets were opened for specific date. I mean:

Date1 = 3 tickets
Date2 = 3 tickets + 1 ticket = 4 tickets
Date3 = 4 tickets + 2 tickets = 6 tickets

Is it possible?

For now I've built a graph with "how many tickets were opened in date1, date2, date3", but I need some kind of aggregation.

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can use your tickets opened per each day to accumulate that:

... | stats count by OpenDate | accum count as openTickets

Verify that your rows are sorted by date correctly before the accum.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can use your tickets opened per each day to accumulate that:

... | stats count by OpenDate | accum count as openTickets

Verify that your rows are sorted by date correctly before the accum.

martin_mueller
SplunkTrust
SplunkTrust

Great. Don't forget to mark this as solved.

0 Karma

rus7am
Explorer

thanks a lot! that's works!

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...