Splunk Search

Lookup latest value in CSV or datasource

Greenwell01
New Member

Hi,
I am currently tracking my electricity usage and would like to calculate the current cost using the kWh value in Splunk. I have also created a csv value with the current cost per kWh and imported the data as a different source type with in the energy index.

I can now is to determine the usage since the beginning of the month in kWh but still need to determine the costs by multiply it with the cost shown as the latest entry of the csv file.

Any pointers?

Tags (1)
0 Karma

snoobzilla
Builder

Need more details.

Taking a guess... something like the following should work assuming you have a cost field unique to the cost data events.

search usageevent OR costevent
| eventstats last(costfield) AS CostThisPeriod
| stats sum(usage) AS usage values(CostThisPeriod) AS CostThisPeriod by customer
| eval billing=usage*CostThisPeriod
0 Karma

lguinn2
Legend

It would help if we could see the CSV file and understand the field headings...

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...