Reporting

histogram report of purchase amount

andyk
Path Finder

I have events that contains an amount. How do I create a histogram report that counts events grouped into these intervalls:

lt 100

100 – 149

150 – 199

200 – 249

250 – 299

300 – 349

350 – 399

300 – 449

450 – 499

gt 500

Tags (3)
0 Karma
1 Solution

andyk
Path Finder

Just after I wrote the question it came to me, the eval command:

search | eval amount= if(amount < 100, "99", amount) | eval amount= if(amount > 500, "501", amount)| bucket amount span=50 | stats count by amount | sort by amount

Someone with more experiance maybe can check if this is the correct way to do it.

View solution in original post

0 Karma

andyk
Path Finder

Just after I wrote the question it came to me, the eval command:

search | eval amount= if(amount < 100, "99", amount) | eval amount= if(amount > 500, "501", amount)| bucket amount span=50 | stats count by amount | sort by amount

Someone with more experiance maybe can check if this is the correct way to do it.

0 Karma
Get Updates on the Splunk Community!

Splunk Platform | Upgrading your Splunk Deployment to Python 3.9

Splunk initially announced the removal of Python 2 during the release of Splunk Enterprise 8.0.0, aiming to ...

From Product Design to User Insights: Boosting App Developer Identity on Splunkbase

co-authored by Yiyun Zhu & Dan Hosaka Engaging with the Community at .conf24 At .conf24, we revitalized the ...

Detect and Resolve Issues in a Kubernetes Environment

We’ve gone through common problems one can encounter in a Kubernetes environment, their impacts, and the ...