Reporting

compare no. of events with a specific value, to the no. events with other values

andyk
Path Finder

I have events that looks something like this:

merchant_id=5755757 status_id=22 amount=300

Now I want to compare the number of events from one specific merchant to the number of events from all the other merchants in a stacked bar diagram split by "specific merchant" / "other merchants". How can I do this?

The diagram should show the last 30 days, with one bar per day.

Tags (1)
0 Karma
1 Solution

Ayn
Legend

You could achieve this using eval to split up merchants across either your specific merchant or other merchants.

<yourbasesearch>
 | eval merchant_type=if(merchant_id==5755757,"Current merchant","Other merchants")
 | timechart span=1d count by merchant_type

View solution in original post

Ayn
Legend

You could achieve this using eval to split up merchants across either your specific merchant or other merchants.

<yourbasesearch>
 | eval merchant_type=if(merchant_id==5755757,"Current merchant","Other merchants")
 | timechart span=1d count by merchant_type

andyk
Path Finder

Works perfect, thanks!

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...