Reporting

histogram report of purchase amount

andyk
Path Finder

I have events that contains an amount. How do I create a histogram report that counts events grouped into these intervalls:

lt 100

100 – 149

150 – 199

200 – 249

250 – 299

300 – 349

350 – 399

300 – 449

450 – 499

gt 500

Tags (3)
0 Karma
1 Solution

andyk
Path Finder

Just after I wrote the question it came to me, the eval command:

search | eval amount= if(amount < 100, "99", amount) | eval amount= if(amount > 500, "501", amount)| bucket amount span=50 | stats count by amount | sort by amount

Someone with more experiance maybe can check if this is the correct way to do it.

View solution in original post

0 Karma

andyk
Path Finder

Just after I wrote the question it came to me, the eval command:

search | eval amount= if(amount < 100, "99", amount) | eval amount= if(amount > 500, "501", amount)| bucket amount span=50 | stats count by amount | sort by amount

Someone with more experiance maybe can check if this is the correct way to do it.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...