Lookup latest value in CSV or datasource

[Greenwell01]

Hi,
I am currently tracking my electricity usage and would like to calculate the current cost using the kWh value in Splunk. I have also created a csv value with the current cost per kWh and imported the data as a different source type with in the energy index.

I can now is to determine the usage since the beginning of the month in kWh but still need to determine the costs by multiply it with the cost shown as the latest entry of the csv file.

Any pointers?

[snoobzilla]

Need more details.

Taking a guess... something like the following should work assuming you have a cost field unique to the cost data events.

search usageevent OR costevent
| eventstats last(costfield) AS CostThisPeriod
| stats sum(usage) AS usage values(CostThisPeriod) AS CostThisPeriod by customer
| eval billing=usage*CostThisPeriod

[lguinn2]

It would help if we could see the CSV file and understand the field headings...