<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Creating a report determines values by mv / transaction fields in Reporting</title>
    <link>https://community.splunk.com/t5/Reporting/Creating-a-report-determines-values-by-mv-transaction-fields/m-p/42479#M905</link>
    <description>&lt;P&gt;Figured it out, using a subsearch:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;eventtype="MetricEvent" [ search eventtype="ActionEvent" ActionValue&amp;gt;0 | dedup VisitorID | fields + VisitorID  ] 
  | stats first(SomeMetric) as average_field by VisitorID category
  | stats sum(average_field) as total_metric by VisitorID 
  | eval actionVisitor=1 
  | append [ search eventtype=MetricEvent NOT [ search eventtype="ActionEvent" ActionValue&amp;gt;0 | dedup VisitorID | fields + VisitorID ]
    | stats first(SomeMetric) as average_field by VisitorID category 
    | stats sum(average_field) as total_metric by VisitorID 
    | eval actionVisitor=0 
  ] 
  | stats avg(total_metric) by actionVisitor
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Thu, 23 Aug 2012 12:49:05 GMT</pubDate>
    <dc:creator>brettcave</dc:creator>
    <dc:date>2012-08-23T12:49:05Z</dc:date>
    <item>
      <title>Creating a report determines values by mv / transaction fields</title>
      <link>https://community.splunk.com/t5/Reporting/Creating-a-report-determines-values-by-mv-transaction-fields/m-p/42478#M904</link>
      <description>&lt;P&gt;I have a report that allows me to get a list of certain values per user:&lt;/P&gt;

&lt;P&gt;data: &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;visitorID: A, category: foo, SomeMetric: 32
visitorID: A, category: foo, SomeMetric: 27
visitorID: A, category: bar, SomeMetric: 17
visitorID: A, action: someAction, actionValue: 3
visitorID: A, action: someAction, actionValue: 0
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;In above, fields are extracted. The first 3 events are MetricEvents, and the last one is an ActionEvent. Query:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;eventtype="MetricEvent" OR eventtype="ActionEvent | stats first(SomeMetric) as average_field by visitorId category | stats sum(average_field) as total_metric by VisitorID
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Result: &lt;CODE&gt;visitor: A, total_metric: 49&lt;/CODE&gt;&lt;/P&gt;

&lt;P&gt;I can also categorize visitors based on action events:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;eventtype="MetricEvent" OR eventtype="ActionEvent | transaction visitorId | eval isActionValueVisitor=if(eventtype="ActionEvent" AND mvindex(ActionValue,mvcount(ActionValue)) &amp;gt; 0, 1, 0) | table visitorId isActionValueVisitor
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I now can get a table with a list of users that have completed action with actionvalue &amp;gt; 0, vs visitors that have not completed action. But I would like to combine the 2 to get a report that shows the average of total_metric by isActionValueVisitor (from there I can run through stats to see how many users there are within each category). However, I can't get the 2 queries to work together, because of the use of stats / transactions in the 2 queries. (I could work it out if mvindex returned the natural order, mvindex / mvfind with a transaction sorts the field alphanumerically, so I have no way of getting the equivalent of "first()" from stats ).&lt;/P&gt;

&lt;P&gt;How could I go about getting the value of visitors that are categorized based on transactions? (or a completely different approach?)&lt;/P&gt;

&lt;P&gt;desired result:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;visitor: A, total_metric: 49, isValueVisitor: 1
visitor: B, total_metric: 23, isValueVisitor: 0
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Thanks&lt;BR /&gt;
Brett&lt;/P&gt;</description>
      <pubDate>Thu, 23 Aug 2012 11:59:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Creating-a-report-determines-values-by-mv-transaction-fields/m-p/42478#M904</guid>
      <dc:creator>brettcave</dc:creator>
      <dc:date>2012-08-23T11:59:15Z</dc:date>
    </item>
    <item>
      <title>Re: Creating a report determines values by mv / transaction fields</title>
      <link>https://community.splunk.com/t5/Reporting/Creating-a-report-determines-values-by-mv-transaction-fields/m-p/42479#M905</link>
      <description>&lt;P&gt;Figured it out, using a subsearch:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;eventtype="MetricEvent" [ search eventtype="ActionEvent" ActionValue&amp;gt;0 | dedup VisitorID | fields + VisitorID  ] 
  | stats first(SomeMetric) as average_field by VisitorID category
  | stats sum(average_field) as total_metric by VisitorID 
  | eval actionVisitor=1 
  | append [ search eventtype=MetricEvent NOT [ search eventtype="ActionEvent" ActionValue&amp;gt;0 | dedup VisitorID | fields + VisitorID ]
    | stats first(SomeMetric) as average_field by VisitorID category 
    | stats sum(average_field) as total_metric by VisitorID 
    | eval actionVisitor=0 
  ] 
  | stats avg(total_metric) by actionVisitor
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Thu, 23 Aug 2012 12:49:05 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Creating-a-report-determines-values-by-mv-transaction-fields/m-p/42479#M905</guid>
      <dc:creator>brettcave</dc:creator>
      <dc:date>2012-08-23T12:49:05Z</dc:date>
    </item>
    <item>
      <title>Re: Creating a report determines values by mv / transaction fields</title>
      <link>https://community.splunk.com/t5/Reporting/Creating-a-report-determines-values-by-mv-transaction-fields/m-p/42480#M906</link>
      <description>&lt;P&gt;There must be a simple way to pivot the results more easily than what I am doing...&lt;/P&gt;

&lt;P&gt;From: &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;actionVisitor       average_total_metric
0                   33
1                   18
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;To:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;Metric           Action Visitors        Non Action Visitors
Average Met      18                     33
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;This is what I have, I know there must be a simpler way to do this. &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; .... | eval Metric="Average Met" | eval ActionVisitorAvg=if(actionVisitor==1,avg_total_metric,0) | eval NonActionVisitorAvg=if(actionVisitor==0, avg_total_metric,0) | stats sum(NonActionVisitorAvg) as NonActionVisitorAvg sum(ActionVisitorAvg) as ActionVisitorAvg by Metric
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Thu, 23 Aug 2012 13:16:52 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Creating-a-report-determines-values-by-mv-transaction-fields/m-p/42480#M906</guid>
      <dc:creator>brettcave</dc:creator>
      <dc:date>2012-08-23T13:16:52Z</dc:date>
    </item>
  </channel>
</rss>

