You can write a search to populate that. basically a rex should do it . When the data is indexed is splunk placing the timestamp? There will be a _time value which will denote the time of the event ( In your case its very likely that splunk places the timestamp of when the file was indexed instead of the _time of event). So if a file in july has been indexed in Aug it might place the date in Aug when the file has been indexed as the _time value. Coming back to rex <| rex field=source "BTM_NET_(?\w+)\."> will give you the month. To limit the data to this you might want to do this if the _time value becomes an issue. sourcetype=<yoursourcetype> source=*$Month$.csv | <remainingsearch> ... View more

Hello Ajay, That is not actually a problem from splunk end. You don't have enough data to tell splunk which date to take so automatically it takes the current system date from where you do the data upload. in your case timerange picker also should work fine if you can show it on a monthly basis. The query has to be formed likewise. Regarding the lookup what exactly would you match up? If you do the lookup on the splunk query timerange picker will not have any effect as it looks for the splunk events rather than the non-existing data which is formed after the query is triggered. To have a the trend it will be better if you can have the same included in your csv file rather than going for lookup implementation which is quite expensive on maintenance and configuration. Thanks, L ... View more

thanks Abishek 🙂 ... View more

Transaction↕ Success Rate (%)↕ Response Time (Secs)↕ Count↕ Login Start 99.22 1.31 Login Result Success 100 3.5 Login Result wrong username/pwd 99.97 2.1 i wish the output is in this form ... View more