topic How to calculate a value from 2 different sources? in Splunk Search

How to calculate a value from 2 different sources?

kirthi_d — Wed, 30 Sep 2020 02:32:00 GMT

I am pretty new to splunk. It would be great if someone can help me with a search command. I have productId as one of fields in my index data. I added lookup from products.csv which has productId, product_name & price. Now I need a bar chart with top 5 most selling products. How to get the total price from count and price? My current search is as below:

index=* action="purchase" |lookup products productId as productId OUTPUT product_name price | top limit =5 product_name

The above query gives me count of purchase transactions by productId. How to get the total sale amount for each product. something like:
Product Name & Sale price (count by productId * price).
Also how to make each bar a different color. The below is not helping:
option name="charting.seriesColors">[0x12BF05,0xEAD619,0xBF2105,0xD71F93,0xC294B1]

Thanks in advance.

Re: How to calculate a value from 2 different source

richgalloway — Sat, 12 Oct 2019 23:41:04 GMT

To get the total sale, first count the number of sales for each product then multiply that number by the price.

index=* action="purchase" |lookup products productId as productId OUTPUT product_name price 
| top limit =5 product_name
| stats count values(price) as price by product_name
| eval totalSale = count * price
| table product_name count price totalSale

Re: How to calculate a value from 2 different source

kirthi_d — Sun, 13 Oct 2019 02:50:11 GMT

Thanks. For some reason when I use top, it doesn't display price or totalSale. I removed top and replaced with sort and head 5. It is not the best way to do, but dont know why top is creating problem

Re: How to calculate a value from 2 different source

richgalloway — Sun, 13 Oct 2019 13:40:12 GMT

top is a transforming command, similar to stats, meaning it only returns the fields explicitly named in the arguments. Usually, when top limit=5 foo is used, they really want sort 5 foo.

Re: How to calculate a value from 2 different source

kirthi_d — Sun, 13 Oct 2019 21:19:55 GMT

got it. I included the fields and looks perfect now. Thanks much..