topic Re: Comparing appVersions over time in Splunk Search

Comparing appVersions over time

khanyag1 — Wed, 30 Sep 2020 01:48:00 GMT

Hi, I am trying to compare my latest app vs all the other app Version to evaluate adoption rate. I would like to display this is a visual format

This is my search so far:
index=web sourcetype=Prod application
|eval Version=if('Version'="3.0", "3.0", "NOT 3.0")
|stats dc(Users) as Unique_Users by Version
|eventstats sum(Unique_Users) as AllUsers
|eval percent= round( Unique_Users/AllUsers)
|appendpipe
[ search index=web sourcetype=Prod application Version="*"
|stats....]

Re: Comparing appVersions over time

somesoni2 — Mon, 19 Aug 2019 19:29:33 GMT

Can you post some sample output (columns you want to show with sample values)?

Re: Comparing appVersions over time

khanyag1 — Mon, 19 Aug 2019 19:38:47 GMT

@somesoni2 I was hoping to see Version and Total Users. I would like 2 different line charts(1 for every version that is not 3.0 and one that is 3.0). Ambitiously, I would also like to separate it by operating system so windows vs mac but I didn't include that in my initial search.

Re: Comparing appVersions over time

khanyag1 — Mon, 19 Aug 2019 21:17:02 GMT

@somesoni2 I was hoping to have the latest version on one line(by total users) and then the other versions on another line(total users) by Operating system(windows/mac). I'm hoping to use a visualization line chart. In my search I didn't include the OS although that's what I want to end up doing.

Re: Comparing appVersions over time

woodcock — Mon, 19 Aug 2019 21:47:18 GMT

I do not understand why this is insufficient; do explain more:

index=web AND sourcetype=Prod application
|eval Version=if('Version'="3.0", "3.0", "NOT 3.0")
|stats dc(Users) as Unique_Users by Version
|eventstats sum(Unique_Users) AS AllUsers
|eval percent= round(Unique_Users/AllUsers)

Re: Comparing appVersions over time

khanyag1 — Tue, 20 Aug 2019 12:18:06 GMT

@woodcock it's insufficient because on my line chart, I am not seeing the other versions. I have a line that says from 3.0- Not 3.0. I would like to see the other versions as well.

Re: Comparing appVersions over time

woodcock — Tue, 20 Aug 2019 13:04:27 GMT

So get rid of that eval line.

Re: Comparing appVersions over time

khanyag1 — Wed, 21 Aug 2019 11:52:23 GMT

@woodcock I did try this and it didn't work

Re: Comparing appVersions over time

woodcock — Mon, 02 Sep 2019 16:19:49 GMT

It worked fine for me. Cut and paste from this answer or type it in again. Maybe you have some stray invisible control character in your SPL?

Re: Comparing appVersions over time

khanyag1 — Mon, 09 Sep 2019 13:11:34 GMT

Thank you, it's still not working. Not sure why it didn't work for me. I removed the append pipe in my original and it's close to what I need for now. I want to further break it down so that the latest version automatically populates on it's own without manual input. Is this possible?