topic Re: Please Help in Splunk Search

Please Help

sumitp10797 — Fri, 31 Dec 2021 06:47:15 GMT

Provide details about client purchase details

1. Total purchase split by product ID

2. Total Products split by product ID

with raw data

ashvinpandey — Fri, 31 Dec 2021 07:05:14 GMT

@sumitp10797 Try using below queries:

1. Total purchase split by product ID

index=<<your_index> sourcetype=<<your_sourcetype>> | stats sum(purchase_field) as purchase by product_id

2. Total Products split by product ID

index=<<your_index> sourcetype=<<your_sourcetype>> | stats sum(products_field) as products by product_id

3. Both Combined Query:

index=<<your_index> sourcetype=<<your_sourcetype>> | stats sum(purchase_field) as purchase sum(products_field) as products by product_id

Also, if this reply helped you in solving your problem an up-vote would be appreciated.

ashvinpandey — Fri, 31 Dec 2021 13:32:31 GMT

@sumitp10797 Also if you received you answer please mark it as a solution so that I can be used by others for a reference.