Splunk Search

Lookup latest value in CSV or datasource

Greenwell01
New Member

Hi,
I am currently tracking my electricity usage and would like to calculate the current cost using the kWh value in Splunk. I have also created a csv value with the current cost per kWh and imported the data as a different source type with in the energy index.

I can now is to determine the usage since the beginning of the month in kWh but still need to determine the costs by multiply it with the cost shown as the latest entry of the csv file.

Any pointers?

Tags (1)
0 Karma

snoobzilla
Builder

Need more details.

Taking a guess... something like the following should work assuming you have a cost field unique to the cost data events.

search usageevent OR costevent
| eventstats last(costfield) AS CostThisPeriod
| stats sum(usage) AS usage values(CostThisPeriod) AS CostThisPeriod by customer
| eval billing=usage*CostThisPeriod
0 Karma

lguinn2
Legend

It would help if we could see the CSV file and understand the field headings...

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...