https://community.splunk.com/t5/Splunk-Search/Using-Search-Tutorial-data-how-to-search-for-the-total-number-of/m-p/134488#M36761 <P>This is a great example to add to the Search Tutorial. Thank you! <span class="lia-unicode-emoji" title=":grinning_face_with_smiling_eyes:">😄</span></P> Wed, 26 Nov 2014 08:32:40 GMT sophy 2014-11-26T08:32:40Z https://community.splunk.com/t5/Splunk-Search/Using-Search-Tutorial-data-how-to-search-for-the-total-number-of/m-p/134486#M36759 <P>Hi, I'm going over the search tutorial and have a question regarding the stats command.</P> <P>What I'm trying to find is to find best selling item, number of best selling item sold and total number of items sold by country.</P> <P>I've managed to get the stats for both best selling item and total number of items sold but not the number of best selling item sold.</P> <P>My search query is</P> <PRE><CODE>buttercup* price=* action=purchase|iplocation clientip|stats max(productId) as "Best Seller" count as "Sold Total" by Country </CODE></PRE> <P>I've tried count(max(productId)) which doesn't seem to work.</P> <P>Can I get help or any suggestion for which command to use to get a chart like</P> <PRE><CODE> Country Best Seller Sold Sold Total Argentina WC-SH-G04 3 11 </CODE></PRE> <P>Thanks in advance!</P> Tue, 25 Nov 2014 16:12:37 GMT https://community.splunk.com/t5/Splunk-Search/Using-Search-Tutorial-data-how-to-search-for-the-total-number-of/m-p/134486#M36759 hcheang 2014-11-25T16:12:37Z https://community.splunk.com/t5/Splunk-Search/Using-Search-Tutorial-data-how-to-search-for-the-total-number-of/m-p/134487#M36760 <P>Try this</P> <PRE><CODE>buttercup* price=* action=purchase|iplocation clientip | stats count by productId Country | eventstats max(count) as max by Country | eval BestSeller=if(count=max,productId,null()) | stats values(BestSeller) as "Best Seller" , first(max) as Sold, sum(count) as "Sold Total" by Country </CODE></PRE> Tue, 25 Nov 2014 16:22:05 GMT https://community.splunk.com/t5/Splunk-Search/Using-Search-Tutorial-data-how-to-search-for-the-total-number-of/m-p/134487#M36760 somesoni2 2014-11-25T16:22:05Z https://community.splunk.com/t5/Splunk-Search/Using-Search-Tutorial-data-how-to-search-for-the-total-number-of/m-p/134488#M36761 <P>This is a great example to add to the Search Tutorial. Thank you! <span class="lia-unicode-emoji" title=":grinning_face_with_smiling_eyes:">😄</span></P> Wed, 26 Nov 2014 08:32:40 GMT https://community.splunk.com/t5/Splunk-Search/Using-Search-Tutorial-data-how-to-search-for-the-total-number-of/m-p/134488#M36761 sophy 2014-11-26T08:32:40Z