Splunk Search

Data manipulation. Is this feasible ?

reverse
Contributor

Let's say I have a CSV with 2 columns
So I have transactions count per day mentioned against the date..
Now I want to show graph where i can show on which date OR how many days it took to reach 1 million ,2 million,3 million .. so on . ..
Feasible ?

Date Count
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @reverse,
let me understand:

  • you have a lookup that contains rows with two fields: date and count,
  • you want a graph with on x the dates and on Y the values,
  • then you want to compare these values with some limits (e.g. limit1=1M and limit2=2M);

is this correct?

If this is your need you could run a search like this:

| inputlookup your_lookup.csv
| chart values(count) AS count BY date
| eval limit1=1000000, limit2=2000000

and use it in a dashboard's panel like this:

<dashboard>
  <label>test_overlay_2</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>
               | inputlookup your_lookup.csv
               | chart values(count) AS count BY date
               | eval limit1=1000000, limit2=2000000
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.overlayFields">limit1,limit2</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
</dashboard>

Ciao.
Giuseppe

0 Karma

reverse
Contributor

I have below CSV ..

I want to identify how many days it took to reach 1st million .. 2nd million .. so on ..

Date Transactions Net Count
5/1/2019 0
5/2/2019 0
5/3/2019 0
5/4/2019 0
5/5/2019 0
5/6/2019 0
5/7/2019 0
5/8/2019 136
5/9/2019 62344
5/10/2019 118776
5/11/2019 119394
5/12/2019 124998
5/13/2019 255242
5/14/2019 407902
5/15/2019 545374
5/16/2019 693342
5/17/2019 823672
5/18/2019 824987
5/19/2019 825994
5/20/2019 963299
5/21/2019 1128368
5/22/2019 1273399
5/23/2019 1409096
5/24/2019 1548648
5/25/2019 1549038
5/26/2019 1549241
5/27/2019 1549437
5/28/2019 1703438
5/29/2019 1863571
5/30/2019 2023886
5/31/2019 2169741
6/1/2019 2171281
6/2/2019 2172752
6/3/2019 2357376
6/4/2019 2549456
6/5/2019 2748790
6/6/2019 2925480
6/7/2019 3094447
6/8/2019 3094937
6/9/2019 3096621
6/10/2019 3302982
6/11/2019 3530454
6/12/2019 3743284
6/13/2019 3957966
6/14/2019 4134705
6/15/2019 4135043
6/16/2019 4138509
6/17/2019 4356140
6/18/2019 4581721
6/19/2019 4807367
6/20/2019 5028887
6/21/2019 5250289
6/22/2019 5252730
6/23/2019 5265504
6/24/2019 5542090
6/25/2019 5801049
6/26/2019 6087436
6/27/2019 6341174
6/28/2019 6584475
6/29/2019 6584590
6/30/2019 6584640
7/1/2019 6720785
7/2/2019 6855255
7/3/2019 7116670
7/4/2019 7121355
7/5/2019 7362331
7/6/2019 7364580
7/7/2019 7365988
7/8/2019 7636042
7/9/2019 7920961
7/10/2019 8203068
7/11/2019 8485787
7/12/2019 8727653
7/13/2019 8792477
7/14/2019 8795300
7/15/2019 9087292
7/16/2019 9375926
7/17/2019 9662508
7/18/2019 9952211
7/19/2019 10212747
7/20/2019 10212864
7/21/2019 10216125
7/22/2019 10518348
7/23/2019 10835836
7/24/2019 11158939
7/25/2019 11465130
7/26/2019 11740613
7/27/2019 11741652
7/28/2019 11744143
7/29/2019 12051891
7/30/2019 12369031
7/31/2019 12668196
8/1/2019 12977702
8/2/2019 13265981
8/3/2019 13351765
8/4/2019 13355804
8/5/2019 13677489
8/6/2019 14019882
8/7/2019 14332307
8/8/2019 14648741
8/9/2019 14949548
8/10/2019 14975147
8/11/2019 14979884
8/12/2019 15317020
8/13/2019 15653665
8/14/2019 15959909
8/15/2019 16286073
8/16/2019 16586463
8/17/2019 16588907
8/18/2019 16595103
8/19/2019 16942456
8/20/2019 17278620
8/21/2019 17615380
8/22/2019 18022197
8/23/2019 18346390
8/24/2019 18352398
8/25/2019 18355892
8/26/2019 18721763
8/27/2019 19090736
8/28/2019 19454931
8/29/2019 19808846
8/30/2019 20110190
8/31/2019 20110193
9/1/2019 20111165
9/2/2019 20147008
9/3/2019 20492737
9/4/2019 20819653
9/5/2019 21157604
9/6/2019 21496360
9/7/2019 21496364
9/8/2019 21502498
9/9/2019 21866897
9/10/2019 22233207
9/11/2019 22561647
9/12/2019 22900983
9/13/2019 23210343
9/14/2019 23227905
9/15/2019 23231311
9/16/2019 23598761
9/17/2019 23953395
9/18/2019 24279978
9/19/2019 24670278
9/20/2019 24968218
9/21/2019 25002016
9/22/2019 25002233
9/23/2019 25362739
9/24/2019 25557055
9/25/2019 25909864
9/26/2019 26253312
9/27/2019 26551231
9/28/2019 26551261
9/29/2019 26551477
9/30/2019 26951729
10/1/2019 27409916
10/2/2019 27831962
10/3/2019 28257589
10/4/2019 28665147
10/5/2019 28665371
10/6/2019 28665585
10/7/2019 29150528
10/8/2019 29628877
10/9/2019 30086053
10/10/2019 30535860
10/11/2019 30937292
10/12/2019 31027756
10/13/2019 31027953
10/14/2019 31244053
10/15/2019 31707531
10/16/2019 32210767
10/17/2019 32698435
10/18/2019 33152677
10/19/2019 33167537
10/20/2019 33168426
10/21/2019 33689438
10/22/2019 34237851
10/23/2019 34806248
10/24/2019 35459885
10/25/2019 36047463
10/26/2019 36201224
10/27/2019 36201975
10/28/2019 36823376
10/29/2019 37464217
10/30/2019 38088407
10/31/2019 38688976
11/1/2019 39262023
11/2/2019 39262122
11/2/2019 39262221
11/3/2019 39263013
11/4/2019 39888012
11/5/2019 40086915
11/6/2019 40712066
11/7/2019 41361170
11/8/2019 41966551
11/9/2019 42061220
11/10/2019 42062234
11/11/2019 42303351
11/12/2019 42937628

0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...