Reporting

histogram report of purchase amount

andyk
Path Finder

I have events that contains an amount. How do I create a histogram report that counts events grouped into these intervalls:

lt 100

100 – 149

150 – 199

200 – 249

250 – 299

300 – 349

350 – 399

300 – 449

450 – 499

gt 500

Tags (3)
0 Karma
1 Solution

andyk
Path Finder

Just after I wrote the question it came to me, the eval command:

search | eval amount= if(amount < 100, "99", amount) | eval amount= if(amount > 500, "501", amount)| bucket amount span=50 | stats count by amount | sort by amount

Someone with more experiance maybe can check if this is the correct way to do it.

View solution in original post

0 Karma

andyk
Path Finder

Just after I wrote the question it came to me, the eval command:

search | eval amount= if(amount < 100, "99", amount) | eval amount= if(amount > 500, "501", amount)| bucket amount span=50 | stats count by amount | sort by amount

Someone with more experiance maybe can check if this is the correct way to do it.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...