Splunk Search

Lookup latest value in CSV or datasource

Greenwell01
New Member

Hi,
I am currently tracking my electricity usage and would like to calculate the current cost using the kWh value in Splunk. I have also created a csv value with the current cost per kWh and imported the data as a different source type with in the energy index.

I can now is to determine the usage since the beginning of the month in kWh but still need to determine the costs by multiply it with the cost shown as the latest entry of the csv file.

Any pointers?

Tags (1)
0 Karma

snoobzilla
Builder

Need more details.

Taking a guess... something like the following should work assuming you have a cost field unique to the cost data events.

search usageevent OR costevent
| eventstats last(costfield) AS CostThisPeriod
| stats sum(usage) AS usage values(CostThisPeriod) AS CostThisPeriod by customer
| eval billing=usage*CostThisPeriod
0 Karma

lguinn2
Legend

It would help if we could see the CSV file and understand the field headings...

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...