Splunk Search

How to load two CSV files into Splunk to compare both and present the results using bar graphs/charts?

saurabh_tek
Communicator

I want to load two CSV files into Splunk to compare both and present the results using bar graphs/charts. Suggest me the commands for the same please.

0 Karma

somesoni2
Revered Legend

It would tough to suggest you anything without knowing more information here. Where are the CSV files location, are they available as lookup table file (under etc/apps/YourApp/lookups) OR they are regular CSV files that you can copy to Splunk search head server (under $SPLUNK_HOME/var/run/splunk) OR they are indexed into Splunk under an index and sourcetype?? There will be different method/command to retrieve the data from both CSV based on this (inputlookup OR inputcsv OR regular base search). Once that is available, you can compare the data like this (again what all fields are there and what you want to compare will derive the result here), assuming there is a common field between those two CSVs...

[Search to get data from CSV1 | table commonfield fieldtocompare1 field2compare2... | eval from="CSV1" | append [Search to get data from CSV2 | table commonfield fieldtocompare1 field2compare2... | eval from="CSV2"] | chart limit=0 values(fieldtocompare1) as fieldtocompare1  values(fieldtocompare2) as fieldtocompare1  over commonfield by from

This should give you fields like fieldtocompare1:CSV1 and fieldtocompare1:CSV2 which you can compare using eval or something.

0 Karma

jimmoriarty
Path Finder

Can you supply the structure (i.e. the headers) of those csv files (or close facsimile) and what sort of comparison you actually want to make.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...