Splunk Search

1. Total purchase split by product ID

dilip7504
New Member

please provide me solution on tutorial data

Client purchase details:
Provide details about client purchase details
1. Total purchase split by product ID
2. Total Products split by product ID

Tags (1)
0 Karma

renjith_nair
Legend

Hi @dilip7504,

In general, you could get it by ,

your search terms | stats coun(purchase) as Total_Purchase,count(Products) as Total_Products by product_id    

If this doesn't work , please provide some sample events

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

dilip7504
New Member

doesn't work

sourcetype=access_* | stats count(purchase) as Total_Purchase,count(Products) as Total_Products by product_id

this is work

sourcetype=access_* action="purchase"| stats count as product by productId

0 Karma

renjith_nair
Legend

OK . Do you have any pending issues?

If you are experimenting with the tutorial data , then this might help https://www.splunk.com/en_us/resources/video.gzdGVpbzqfsrZ6zSHd2qbGhuXBhMrEME.html

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...