Splunk Search

Comparing appVersions over time

khanyag1
New Member

Hi, I am trying to compare my latest app vs all the other app Version to evaluate adoption rate. I would like to display this is a visual format

This is my search so far:
index=web sourcetype=Prod application
|eval Version=if('Version'="3.0", "3.0", "NOT 3.0")
|stats dc(Users) as Unique_Users by Version
|eventstats sum(Unique_Users) as AllUsers
|eval percent= round( Unique_Users/AllUsers)
|appendpipe
[ search index=web sourcetype=Prod application Version="*"
|stats....]

Tags (2)
0 Karma

woodcock
Esteemed Legend

I do not understand why this is insufficient; do explain more:

index=web AND sourcetype=Prod application
|eval Version=if('Version'="3.0", "3.0", "NOT 3.0")
|stats dc(Users) as Unique_Users by Version
|eventstats sum(Unique_Users) AS AllUsers
|eval percent= round(Unique_Users/AllUsers)
0 Karma

khanyag1
New Member

@woodcock it's insufficient because on my line chart, I am not seeing the other versions. I have a line that says from 3.0- Not 3.0. I would like to see the other versions as well.

0 Karma

woodcock
Esteemed Legend

So get rid of that eval line.

0 Karma

khanyag1
New Member

@woodcock I did try this and it didn't work

0 Karma

woodcock
Esteemed Legend

It worked fine for me. Cut and paste from this answer or type it in again. Maybe you have some stray invisible control character in your SPL?

0 Karma

khanyag1
New Member

Thank you, it's still not working. Not sure why it didn't work for me. I removed the append pipe in my original and it's close to what I need for now. I want to further break it down so that the latest version automatically populates on it's own without manual input. Is this possible?

0 Karma

khanyag1
New Member

@somesoni2 I was hoping to see Version and Total Users. I would like 2 different line charts(1 for every version that is not 3.0 and one that is 3.0). Ambitiously, I would also like to separate it by operating system so windows vs mac but I didn't include that in my initial search.

0 Karma

somesoni2
Revered Legend

Can you post some sample output (columns you want to show with sample values)?

0 Karma

khanyag1
New Member

@somesoni2 I was hoping to have the latest version on one line(by total users) and then the other versions on another line(total users) by Operating system(windows/mac). I'm hoping to use a visualization line chart. In my search I didn't include the OS although that's what I want to end up doing.

0 Karma
Get Updates on the Splunk Community!

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...

Explore the Latest Educational Offerings from Splunk (November Releases)

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...