https://community.splunk.com/t5/Splunk-Search/how-to-display-decline-rate-per-specified-fields-over-a-period/m-p/356660#M105526 <P>ahh I see, thank you! Looks like that did it</P> Mon, 01 May 2017 21:37:53 GMT demkic 2017-05-01T21:37:53Z https://community.splunk.com/t5/Splunk-Search/how-to-display-decline-rate-per-specified-fields-over-a-period/m-p/356657#M105523 <P>Hello,</P> <P>I am struggling to write a query that displays the decline rate per payment_method over a period of 7 days (with span=1d). </P> <P>Ideally, I would like to display in one graph - a stacked bar chart of total volume of <EM>approved</EM> and <EM>declined</EM> transactions, and overlay that with the <EM>decline rate</EM> per payment_method (where payment method is in the legend) displayed over time (span=1d for 1 week).</P> <PRE><CODE>base query... | bin _time span=1d | stats count(eval(success="false")) as declined, count(eval(success="true")) as approved, count as total by payment_method _time | eval percent_declined=round(declined / total * 100, 1) | table _time payment_method approved declined percent_declined | eval _time=strftime(_time,"%b %e, %Y") | sort -_time </CODE></PRE> <P>Any help is greatly appreciated. </P> Mon, 01 May 2017 01:30:22 GMT https://community.splunk.com/t5/Splunk-Search/how-to-display-decline-rate-per-specified-fields-over-a-period/m-p/356657#M105523 demkic 2017-05-01T01:30:22Z https://community.splunk.com/t5/Splunk-Search/how-to-display-decline-rate-per-specified-fields-over-a-period/m-p/356658#M105524 <P>what is it showing up as now? The syntax, to me, looks accurate enough. Is _time not showing up properly or are you having trouble formatting the chart, or is it that the fields aren't populated correctly?</P> Mon, 01 May 2017 12:06:20 GMT https://community.splunk.com/t5/Splunk-Search/how-to-display-decline-rate-per-specified-fields-over-a-period/m-p/356658#M105524 cmerriman 2017-05-01T12:06:20Z https://community.splunk.com/t5/Splunk-Search/how-to-display-decline-rate-per-specified-fields-over-a-period/m-p/356659#M105525 <P>Try like this</P> <PRE><CODE>base query... | bin _time span=1d | stats count(eval(success="false")) as declined, count(eval(success="true")) as approved, count as total by payment_method _time | eval percent_declined=round(declined / total * 100, 1) | table _time payment_method approved declined percent_declined | timechart span=1d max(approved) max(declined) max(percent_declined) by payment_method </CODE></PRE> Mon, 01 May 2017 15:37:33 GMT https://community.splunk.com/t5/Splunk-Search/how-to-display-decline-rate-per-specified-fields-over-a-period/m-p/356659#M105525 somesoni2 2017-05-01T15:37:33Z https://community.splunk.com/t5/Splunk-Search/how-to-display-decline-rate-per-specified-fields-over-a-period/m-p/356660#M105526 <P>ahh I see, thank you! Looks like that did it</P> Mon, 01 May 2017 21:37:53 GMT https://community.splunk.com/t5/Splunk-Search/how-to-display-decline-rate-per-specified-fields-over-a-period/m-p/356660#M105526 demkic 2017-05-01T21:37:53Z