Splunk Search

create a chart from a csv

chadman
Path Finder

I have a csv file that Splunk ingest and use it to create a chart. It works ok, but I'm not sure how to sort this by date since the data in the csv is not in a real date format. the csv looks like:

Month,Webcam,Speech
July-17,10566,1255
August-17,10612,1248
September-17,10703,1263
October-17,10770,1260
November-17,10872,1267

and this data goes back a few years. Is there a way I can still have it sort by the month/year in my chart? Currently have it sort by a count that so far as gone up. That works for now, but the number could go down and put the months out of order.

Tags (2)
0 Karma
1 Solution

elliotproebstel
Champion

I'd convert Month to a time field with a little bit of data massaging:
| eval time=strptime("01-".Month, "%d-%B-%y")

What I'm doing there is appending "01-" to the start of the month string before converting it withstrptime, because (to the best of my knowledge) strptime requires at least day, month, and year in order to create a valid timestamp. Since you only have one entry per month in your sample data, that should work fine. Then you can just sort based on the time field:
| sort - time

View solution in original post

0 Karma

LeeSart
Explorer

I'd suggest using strptime to convert the date field to epoch time, then sorting on the epoch field. The example below assumes that the field containing your date is called 'date':

base search | eval epoch=strptime(date, "%B-%y") | sort epoch
0 Karma

elliotproebstel
Champion

I'd convert Month to a time field with a little bit of data massaging:
| eval time=strptime("01-".Month, "%d-%B-%y")

What I'm doing there is appending "01-" to the start of the month string before converting it withstrptime, because (to the best of my knowledge) strptime requires at least day, month, and year in order to create a valid timestamp. Since you only have one entry per month in your sample data, that should work fine. Then you can just sort based on the time field:
| sort - time

0 Karma

chadman
Path Finder

thanks, that worked.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...