Populating User Data for the Chargeback App
By: Jeff Rabine | Splunk Consultant
The Chargeback App is designed to help you identify how many SVCs your organization is using by Business Units and Departments. Recently I had a customer that wanted to define a Business Unit as a Vice President and a Department as a Director who reports to the VP. This is completely doable if you are ok with using the original field names that the chargeback app uses. The hardest part about configuring the Chargeback app is getting the data collected and formatted for the chargeback app to use. This blog post is not specifically about the Chargeback App. This blog is about collecting, formatting and populating the user data needed for the chargeback_user_2_bunit_csv_lookup.
The challenge I had with collecting the user data is the data was not all in one place. I had an index that contained user data, and I had a CSV that identified Directors and VPs. What I needed though was a list of users and their associated Director and VP.
I have formulated an example that contains less than 20 users, but this example is working in a production environment that contains over 50,000 users.
In my example I use these two CSVs:
Employee_List.csv
management.csv
The first step is to combine the two data sources and export them as a new CSV. We do this by using the lookup command.
Now that we have the data in a single CSV we can iterate through it to figure out who everyone’s VP and Director is. We do this by using the same lookup over and over as shown below. In this example, we only have to do it three times. In this real-world example, I did this eight times to fully populate the data.
As you can see, we now have much more data, but it is a mess. So lastly, we will coalesce the Director and VP data and we will rename the fields to match the Chargeback App requirements.
As you can see, we now can identify the biz_unit or (VP) and biz_dep or (Director) for all our users.
I hope this article will give you some ideas to when populating user data for the Chargeback app or help you iterate through a lookup multiple times to perhaps create an organizational chart. Happy Splunking!
Want to learn more about lookups or the Chargeback App? Contact us today!