topic Re: chart percentage over over item by user in Splunk Search

chart percentage over over item by user

wang — Tue, 07 Apr 2015 20:55:09 GMT

Let say I have a chart that reports the count of what user has purchased what item. I can create a nice table using chart count over item by user.
===== UserA === UserB === UserC
Item X ====1 =======2 ======= 1
Item Y ==== 2 ====== 3 ======= 5

Now I want each row to report not the count, but the percentage, on a per row basis
====UserA UserB UserC
Item X 25% 50% 25%
Item Y 20% 30% 50%

So essentially, I want to chart percentage over over item by user. How do I do that?

Re: chart percentage over over item by user

lguinn2 — Tue, 07 Apr 2015 21:37:26 GMT

If you want to know the percentage of item X that was purchased by each user, then do this:

yoursearchhere
| stats count by item user
| eventstats sum(count) as total by item
| eval percentage=round(count*100/total,1)
| xyseries item user percentage

Instead of looking at the percentage by item, you could look at it by user - just switch "user" for "item" in line 3

Re: chart percentage over over item by user

wang — Tue, 07 Apr 2015 22:46:12 GMT

Worked perfectly. Thanks for the quick reply.