topic Re: I need complete this query find the top 5 viewed products referred by a domain. in Splunk Search

I need complete this query find the top 5 viewed products referred by a domain.

EdwinOssa — Sun, 11 Jul 2021 11:56:37 GMT

This is my sentence but is not completed. I can't find the solution on Doc.

index=main sourcetype=acc* action=view [search sourcetype=acc* status=200 action=view | top limit=5 referer_domain | table referer_domain productName] | stats count,values(productName),distinct_count(productId) by referer_domain

Re: I need complete this query find the top 5 viewed products referred by a domain.

inventsekar — Sun, 11 Jul 2021 12:56:08 GMT

Hi @EdwinOssa your query is perfect one.. the field "productName" is not available. only "ProductId" is available.

so, you could run:

index=main sourcetype=acc* action=view [search sourcetype=acc* status=200 action=view | top limit=5 referer_domain | table referer_domain] | stats count,values(productId),distinct_count(productId) by referer_domain

Re: I need complete this query find the top 5 viewed products referred by a domain.

EdwinOssa — Wed, 14 Jul 2021 04:02:22 GMT

Thank you so much for your help. Appreciated your time for reply my request. I'm new learning splunk and I have some difficulties to find some results. could you help me one last time with this query.

Plot a trellis chart showing the average time spent on the Buttercup Games website for each user session by browser.

-this is my solution but I'm stuck with the average.

index=main sourcetype=acc* referer_domain=http://www.buttercupgames.com action=view | top limit=20 useragent | chart avg(percent)

after this I only got one line

Re: I need complete this query find the top 5 viewed products referred by a domain.

inventsekar — Thu, 15 Jul 2021 16:12:54 GMT

Sure @EdwinOssa , no problems.. i appreciate your questions and wish you best of luck for your splunk learnings .. (sorry for the late reply)

1) the "chart avg(percent)" is missing a "by" field.. generally

"chart avg(time_spent) by referer_domain"

Please check the search reference document for chart command syntax and examples:

https://docs.splunk.com/Documentation/Splunk/8.0.6/SearchReference/Chart#Basic_examples

2) the time_spent field is not available on the logs i think(i am not sure of the last number that appears on these logs.. that may be the time_spent, but i am not sure)

3) referer_domain is just 4 on these logs. so something missing on your requirement.

Please let us know more details.