Splunk Search

How to load two CSV files into Splunk to compare both and present the results using bar graphs/charts?

saurabh_tek
Communicator

I want to load two CSV files into Splunk to compare both and present the results using bar graphs/charts. Suggest me the commands for the same please.

0 Karma

somesoni2
Revered Legend

It would tough to suggest you anything without knowing more information here. Where are the CSV files location, are they available as lookup table file (under etc/apps/YourApp/lookups) OR they are regular CSV files that you can copy to Splunk search head server (under $SPLUNK_HOME/var/run/splunk) OR they are indexed into Splunk under an index and sourcetype?? There will be different method/command to retrieve the data from both CSV based on this (inputlookup OR inputcsv OR regular base search). Once that is available, you can compare the data like this (again what all fields are there and what you want to compare will derive the result here), assuming there is a common field between those two CSVs...

[Search to get data from CSV1 | table commonfield fieldtocompare1 field2compare2... | eval from="CSV1" | append [Search to get data from CSV2 | table commonfield fieldtocompare1 field2compare2... | eval from="CSV2"] | chart limit=0 values(fieldtocompare1) as fieldtocompare1  values(fieldtocompare2) as fieldtocompare1  over commonfield by from

This should give you fields like fieldtocompare1:CSV1 and fieldtocompare1:CSV2 which you can compare using eval or something.

0 Karma

jimmoriarty
Path Finder

Can you supply the structure (i.e. the headers) of those csv files (or close facsimile) and what sort of comparison you actually want to make.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...