Reporting

compare no. of events with a specific value, to the no. events with other values

andyk
Path Finder

I have events that looks something like this:

merchant_id=5755757 status_id=22 amount=300

Now I want to compare the number of events from one specific merchant to the number of events from all the other merchants in a stacked bar diagram split by "specific merchant" / "other merchants". How can I do this?

The diagram should show the last 30 days, with one bar per day.

Tags (1)
0 Karma
1 Solution

Ayn
Legend

You could achieve this using eval to split up merchants across either your specific merchant or other merchants.

<yourbasesearch>
 | eval merchant_type=if(merchant_id==5755757,"Current merchant","Other merchants")
 | timechart span=1d count by merchant_type

View solution in original post

Ayn
Legend

You could achieve this using eval to split up merchants across either your specific merchant or other merchants.

<yourbasesearch>
 | eval merchant_type=if(merchant_id==5755757,"Current merchant","Other merchants")
 | timechart span=1d count by merchant_type

andyk
Path Finder

Works perfect, thanks!

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...