https://community.splunk.com/t5/Splunk-Search/Field-missing-in-dataset/m-p/549416#M155889 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/233823">@Gauresh96</a>&nbsp;</P><P>sorry for the late reply.</P><P>I analyzed the tutorial data and purchase is not a field but is a action field value, about your request I suggest to try this search:</P><P>&nbsp;</P><LI-CODE lang="markup"> sourcetype=access_combined_wcookie action=purchase | stats count by productId</LI-CODE><LI-CODE lang="markup">sourcetype=access_combined_wcookie action=purchase | lookup prices productId | stats count(product_name) as products by productId</LI-CODE><P>&nbsp;</P> Tue, 27 Apr 2021 07:17:11 GMT aasabatini 2021-04-27T07:17:11Z https://community.splunk.com/t5/Splunk-Search/Field-missing-in-dataset/m-p/549309#M155850 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/115090">@dilip7504</a>&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/136781">@renjith_nair</a>&nbsp;</P><P>I am unable to solve the below problem on "tutorialsdata.zip" provided in documentation as there is no field named as "purchase".&nbsp;</P><P>Client purchase details:</P><OL><LI>Total purchase split by product ID</LI><LI>Total Products&nbsp;split by product ID...</LI></OL> Mon, 26 Apr 2021 08:19:30 GMT https://community.splunk.com/t5/Splunk-Search/Field-missing-in-dataset/m-p/549309#M155850 Gauresh96 2021-04-26T08:19:30Z https://community.splunk.com/t5/Splunk-Search/Field-missing-in-dataset/m-p/549310#M155851 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/233823">@Gauresh96</a>,</P><P>you can extract the field with a regex</P><P><A href="https://www.learnsplunk.com/splunk-regex-tutorial.html" target="_blank">https://www.learnsplunk.com/splunk-regex-tutorial.html</A></P><P>or you can use an extraction at search time with the rex comand</P><P><A href="https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Rex" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Rex</A></P><P>&nbsp;</P><P>&nbsp;</P> Mon, 26 Apr 2021 08:23:48 GMT https://community.splunk.com/t5/Splunk-Search/Field-missing-in-dataset/m-p/549310#M155851 aasabatini 2021-04-26T08:23:48Z https://community.splunk.com/t5/Splunk-Search/Field-missing-in-dataset/m-p/549322#M155860 <P>Hello <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/222210">@aasabatini</a>&nbsp;</P><P>Still not getting the result</P><P><A title="Tutorialsdata.zip " href="https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchTutorial/Systemrequirements#Download_the_tutorial_data_files" target="_self">https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchTutorial/Systemrequirements#Download_the_tutorial_data_files</A>&nbsp;</P><P>I have attached the dataset url, can you please check. &nbsp;</P> Mon, 26 Apr 2021 10:35:50 GMT https://community.splunk.com/t5/Splunk-Search/Field-missing-in-dataset/m-p/549322#M155860 Gauresh96 2021-04-26T10:35:50Z https://community.splunk.com/t5/Splunk-Search/Field-missing-in-dataset/m-p/549416#M155889 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/233823">@Gauresh96</a>&nbsp;</P><P>sorry for the late reply.</P><P>I analyzed the tutorial data and purchase is not a field but is a action field value, about your request I suggest to try this search:</P><P>&nbsp;</P><LI-CODE lang="markup"> sourcetype=access_combined_wcookie action=purchase | stats count by productId</LI-CODE><LI-CODE lang="markup">sourcetype=access_combined_wcookie action=purchase | lookup prices productId | stats count(product_name) as products by productId</LI-CODE><P>&nbsp;</P> Tue, 27 Apr 2021 07:17:11 GMT https://community.splunk.com/t5/Splunk-Search/Field-missing-in-dataset/m-p/549416#M155889 aasabatini 2021-04-27T07:17:11Z