Splunk Search

create a chart from a csv

chadman
Path Finder

I have a csv file that Splunk ingest and use it to create a chart. It works ok, but I'm not sure how to sort this by date since the data in the csv is not in a real date format. the csv looks like:

Month,Webcam,Speech
July-17,10566,1255
August-17,10612,1248
September-17,10703,1263
October-17,10770,1260
November-17,10872,1267

and this data goes back a few years. Is there a way I can still have it sort by the month/year in my chart? Currently have it sort by a count that so far as gone up. That works for now, but the number could go down and put the months out of order.

Tags (2)
0 Karma
1 Solution

elliotproebstel
Champion

I'd convert Month to a time field with a little bit of data massaging:
| eval time=strptime("01-".Month, "%d-%B-%y")

What I'm doing there is appending "01-" to the start of the month string before converting it withstrptime, because (to the best of my knowledge) strptime requires at least day, month, and year in order to create a valid timestamp. Since you only have one entry per month in your sample data, that should work fine. Then you can just sort based on the time field:
| sort - time

View solution in original post

0 Karma

LeeSart
Explorer

I'd suggest using strptime to convert the date field to epoch time, then sorting on the epoch field. The example below assumes that the field containing your date is called 'date':

base search | eval epoch=strptime(date, "%B-%y") | sort epoch
0 Karma

elliotproebstel
Champion

I'd convert Month to a time field with a little bit of data massaging:
| eval time=strptime("01-".Month, "%d-%B-%y")

What I'm doing there is appending "01-" to the start of the month string before converting it withstrptime, because (to the best of my knowledge) strptime requires at least day, month, and year in order to create a valid timestamp. Since you only have one entry per month in your sample data, that should work fine. Then you can just sort based on the time field:
| sort - time

0 Karma

chadman
Path Finder

thanks, that worked.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...