Splunk Search
Highlighted

How to load two CSV files into Splunk to compare both and present the results using bar graphs/charts?

Communicator

I want to load two CSV files into Splunk to compare both and present the results using bar graphs/charts. Suggest me the commands for the same please.

0 Karma
Highlighted

Re: How to load two CSV files into Splunk to compare both and present the results using bar graphs/charts?

Path Finder

Can you supply the structure (i.e. the headers) of those csv files (or close facsimile) and what sort of comparison you actually want to make.

0 Karma

Re: How to load two CSV files into Splunk to compare both and present the results using bar graphs/charts?

SplunkTrust
SplunkTrust

It would tough to suggest you anything without knowing more information here. Where are the CSV files location, are they available as lookup table file (under etc/apps/YourApp/lookups) OR they are regular CSV files that you can copy to Splunk search head server (under $SPLUNK_HOME/var/run/splunk) OR they are indexed into Splunk under an index and sourcetype?? There will be different method/command to retrieve the data from both CSV based on this (inputlookup OR inputcsv OR regular base search). Once that is available, you can compare the data like this (again what all fields are there and what you want to compare will derive the result here), assuming there is a common field between those two CSVs...

[Search to get data from CSV1 | table commonfield fieldtocompare1 field2compare2... | eval from="CSV1" | append [Search to get data from CSV2 | table commonfield fieldtocompare1 field2compare2... | eval from="CSV2"] | chart limit=0 values(fieldtocompare1) as fieldtocompare1  values(fieldtocompare2) as fieldtocompare1  over commonfield by from

This should give you fields like fieldtocompare1:CSV1 and fieldtocompare1:CSV2 which you can compare using eval or something.

0 Karma