Getting Data In

How to make a single report from two csv files

dinkarvidyarthy
New Member
| inputlookup SF_Week41.csv 
| fields OpenedDate,ReOpenCount,LastModifiedDate,ResolvedDate,Age(Hours),CaseAge,ClosedDate,CustomerpendingTime,LastCurrentOwnerUpdateDateTime,CaseLastModifiedDate,CaseNumber,Status,OwnerL4,LastResolvedDateassubmit,CumulativeTime(L4),AssignedDateTime(L4),OwnerQueueL4,OwnerLevel,CaseOwner,IssueDefectType,IssueType,IssueSubType,AccountName | eval OpenedWeek=strftime(strptime(OpenedDate,"%m/%d/%Y"),"%V") | eval LastModifiedWeek=strftime(strptime(LastModifiedDate,"%m/%d/%Y"),"%V") | eval ClosedWeek=strftime(strptime(ClosedDate,"%m/%d/%Y"),"%V") | eval ResolvedWeek=strftime(strptime(ResolvedDate,"%m/%d/%Y"),"%V") | eval Morethan30Days = if(CaseAge>30,"Yes","No") | fields Morethan30Days CaseNumber Status OpenedDate OpenedWeek ResolvedDate ResolvedWeek LastModifiedDate LastModifiedWeek ClosedDate ClosedWeek CaseAge | where Morethan30Days="Yes" AND (Status="Customer Pending" OR Status="In Progress") | stats count by Status | addcoltotals count labelfield="Status" label="Total" | rename count as Week41

Output is:

Status                    Week41

Customer Pending          38           

In Progress               66

Total                     104

.

| inputlookup SF.csv | fields OpenedDate,ReOpenCount,LastModifiedDate,ResolvedDate,Age(Hours),CaseAge,ClosedDate,CustomerpendingTime,LastCurrentOwnerUpdateDateTime,CaseLastModifiedDate,CaseNumber,Status,OwnerL4,LastResolvedDateassubmit,CumulativeTime(L4),AssignedDateTime(L4),OwnerQueueL4,OwnerLevel,CaseOwner,IssueDefectType,IssueType,IssueSubType,AccountName | eval OpenedWeek=strftime(strptime(OpenedDate,"%m/%d/%Y"),"%V") | eval LastModifiedWeek=strftime(strptime(LastModifiedDate,"%m/%d/%Y"),"%V") | eval ClosedWeek=strftime(strptime(ClosedDate,"%m/%d/%Y"),"%V") | eval ResolvedWeek=strftime(strptime(ResolvedDate,"%m/%d/%Y"),"%V") | eval Morethan30Days = if(CaseAge>30,"Yes","No") | fields Morethan30Days CaseNumber Status OpenedDate OpenedWeek ResolvedDate ResolvedWeek LastModifiedDate LastModifiedWeek ClosedDate ClosedWeek CaseAge | where Morethan30Days="Yes" AND (Status="Customer Pending" OR Status="In Progress") | stats count by Status | addcoltotals count labelfield="Status" label="Total" | rename count as Week46

Output is:

Status                  Week46

Customer Pending        38

In Progress             62

Total                   100

Is it possible to get both of them in one report like below using append or some other command?
Expected Output :

Status                Week46                            Week41

Customer Pending      38                                38

In Progress           62                                66

Total                 100                               104
0 Karma

jpass
Contributor

you could use append to join the data together. Then run your stats after you've combined them:

| inputlookup SF_Week41.csv
| eval src="sf_week_1"
| append [|inputlookup SF.csv  | eval src="sf"]
0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...