Splunk Search

How to insert static data in dashboard?

iKate
Builder

Hello

Let's say there are several Excel tables and it is needed to make graphs using its data in Splunk dashboard. How can one insert these tables?

Tags (2)
0 Karma
1 Solution

dart
Splunk Employee
Splunk Employee

If I understand correctly, you have data in an excel file, and you want to chart something just from that data in Splunk.

Are you able to export the tables as CSV files?

You can then define a lookup from the csv file, and then use the search command inputlookup to read in the data, which you can then pipe to stats, chart or timechart. For example:

| inputlookup my_lookup_name | chart count by field

View solution in original post

0 Karma

dart
Splunk Employee
Splunk Employee

If I understand correctly, you have data in an excel file, and you want to chart something just from that data in Splunk.

Are you able to export the tables as CSV files?

You can then define a lookup from the csv file, and then use the search command inputlookup to read in the data, which you can then pipe to stats, chart or timechart. For example:

| inputlookup my_lookup_name | chart count by field
0 Karma

iKate
Builder

Nevertheless it was a confusion with "inputlookup" command as it turned out that
1) the command should be strictly in the beginning of the search
2) should start with "|"
3) and the rest of the search should be appended.
All this was not obvius from its description in the search commands reference (maybe just for me).

So my working string looks like this:

| inputlookup my_lookup_csv_file

| append [search source="my_source"
...... ]

Thanks again!

0 Karma

iKate
Builder

Dart, thank you a lot! You showed me the right direction of solving the problem. Now I see vast horizons of how to use this new knowledge..:) I've already tried "inputlookup" and "lookup" and got exactly what I needed!

I used splunk manager interface instead of editing config files to create lookup tables: http://docs.splunk.com/Documentation/Splunk/4.3.3/User/CreateAndConfigureFieldLookups

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...