Splunk Search

How to load two CSV files into Splunk to compare both and present the results using bar graphs/charts?

saurabh_tek
Communicator

I want to load two CSV files into Splunk to compare both and present the results using bar graphs/charts. Suggest me the commands for the same please.

0 Karma

somesoni2
Revered Legend

It would tough to suggest you anything without knowing more information here. Where are the CSV files location, are they available as lookup table file (under etc/apps/YourApp/lookups) OR they are regular CSV files that you can copy to Splunk search head server (under $SPLUNK_HOME/var/run/splunk) OR they are indexed into Splunk under an index and sourcetype?? There will be different method/command to retrieve the data from both CSV based on this (inputlookup OR inputcsv OR regular base search). Once that is available, you can compare the data like this (again what all fields are there and what you want to compare will derive the result here), assuming there is a common field between those two CSVs...

[Search to get data from CSV1 | table commonfield fieldtocompare1 field2compare2... | eval from="CSV1" | append [Search to get data from CSV2 | table commonfield fieldtocompare1 field2compare2... | eval from="CSV2"] | chart limit=0 values(fieldtocompare1) as fieldtocompare1  values(fieldtocompare2) as fieldtocompare1  over commonfield by from

This should give you fields like fieldtocompare1:CSV1 and fieldtocompare1:CSV2 which you can compare using eval or something.

0 Karma

jimmoriarty
Path Finder

Can you supply the structure (i.e. the headers) of those csv files (or close facsimile) and what sort of comparison you actually want to make.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...