<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How to get data by a field when not using stats in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-to-get-data-by-a-field-when-not-using-stats/m-p/127038#M34430</link>
    <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;I am trying to get conversion and average order value and i am using eval function to calculate these. But i want to get these by different applications that we have. If i don't use stats i don't know how to get by application. If i use stats what function to use to just get the evaluated values? i tried values but did not work. &lt;/P&gt;

&lt;P&gt;| stats dc(OrderNumber) as Orders, dc(sessionid) as Visits | eval CVR =(Orders/Visits)*100 | eval Conversion = round(CVR, 1)  | eval AOV=(Revenue/Orders) | eval AOV = round(AOV, 1) | stats values(AOV), values(Conversion) by Application&lt;/P&gt;</description>
    <pubDate>Sun, 03 Nov 2013 16:34:50 GMT</pubDate>
    <dc:creator>xvxt006</dc:creator>
    <dc:date>2013-11-03T16:34:50Z</dc:date>
    <item>
      <title>How to get data by a field when not using stats</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-get-data-by-a-field-when-not-using-stats/m-p/127038#M34430</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;I am trying to get conversion and average order value and i am using eval function to calculate these. But i want to get these by different applications that we have. If i don't use stats i don't know how to get by application. If i use stats what function to use to just get the evaluated values? i tried values but did not work. &lt;/P&gt;

&lt;P&gt;| stats dc(OrderNumber) as Orders, dc(sessionid) as Visits | eval CVR =(Orders/Visits)*100 | eval Conversion = round(CVR, 1)  | eval AOV=(Revenue/Orders) | eval AOV = round(AOV, 1) | stats values(AOV), values(Conversion) by Application&lt;/P&gt;</description>
      <pubDate>Sun, 03 Nov 2013 16:34:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-get-data-by-a-field-when-not-using-stats/m-p/127038#M34430</guid>
      <dc:creator>xvxt006</dc:creator>
      <dc:date>2013-11-03T16:34:50Z</dc:date>
    </item>
    <item>
      <title>Re: How to get data by a field when not using stats</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-get-data-by-a-field-when-not-using-stats/m-p/127039#M34431</link>
      <description>&lt;P&gt;Try to use 'eventstats' instead of the first stats.&lt;/P&gt;</description>
      <pubDate>Sun, 03 Nov 2013 17:23:36 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-get-data-by-a-field-when-not-using-stats/m-p/127039#M34431</guid>
      <dc:creator>rechteklebe</dc:creator>
      <dc:date>2013-11-03T17:23:36Z</dc:date>
    </item>
    <item>
      <title>Re: How to get data by a field when not using stats</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-get-data-by-a-field-when-not-using-stats/m-p/127040#M34432</link>
      <description>&lt;P&gt;&lt;CODE&gt;| stats dc(OrderNumber) as Orders, dc(sessionid) as Visits by Application | eval CVR =(Orders/Visits)*100 | eval Conversion = round(CVR, 1) | eval AOV=(Revenue/Orders) | eval AOV = round(AOV, 1)&lt;/CODE&gt;&lt;/P&gt;</description>
      <pubDate>Sun, 03 Nov 2013 20:07:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-get-data-by-a-field-when-not-using-stats/m-p/127040#M34432</guid>
      <dc:creator>_d_</dc:creator>
      <dc:date>2013-11-03T20:07:39Z</dc:date>
    </item>
    <item>
      <title>Re: How to get data by a field when not using stats</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-get-data-by-a-field-when-not-using-stats/m-p/127041#M34433</link>
      <description>&lt;P&gt;Hi Below solution from &lt;EM&gt;d&lt;/EM&gt; worked for me. I will try evenstats also and see if it works.&lt;/P&gt;</description>
      <pubDate>Sun, 03 Nov 2013 23:40:35 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-get-data-by-a-field-when-not-using-stats/m-p/127041#M34433</guid>
      <dc:creator>xvxt006</dc:creator>
      <dc:date>2013-11-03T23:40:35Z</dc:date>
    </item>
  </channel>
</rss>

