Splunk Search

How to load two CSV files into Splunk to compare both and present the results using bar graphs/charts?

saurabh_tek
Communicator

I want to load two CSV files into Splunk to compare both and present the results using bar graphs/charts. Suggest me the commands for the same please.

0 Karma

somesoni2
Revered Legend

It would tough to suggest you anything without knowing more information here. Where are the CSV files location, are they available as lookup table file (under etc/apps/YourApp/lookups) OR they are regular CSV files that you can copy to Splunk search head server (under $SPLUNK_HOME/var/run/splunk) OR they are indexed into Splunk under an index and sourcetype?? There will be different method/command to retrieve the data from both CSV based on this (inputlookup OR inputcsv OR regular base search). Once that is available, you can compare the data like this (again what all fields are there and what you want to compare will derive the result here), assuming there is a common field between those two CSVs...

[Search to get data from CSV1 | table commonfield fieldtocompare1 field2compare2... | eval from="CSV1" | append [Search to get data from CSV2 | table commonfield fieldtocompare1 field2compare2... | eval from="CSV2"] | chart limit=0 values(fieldtocompare1) as fieldtocompare1  values(fieldtocompare2) as fieldtocompare1  over commonfield by from

This should give you fields like fieldtocompare1:CSV1 and fieldtocompare1:CSV2 which you can compare using eval or something.

0 Karma

jimmoriarty
Path Finder

Can you supply the structure (i.e. the headers) of those csv files (or close facsimile) and what sort of comparison you actually want to make.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...