Splunk Search

Comparing appVersions over time

khanyag1
New Member

Hi, I am trying to compare my latest app vs all the other app Version to evaluate adoption rate. I would like to display this is a visual format

This is my search so far:
index=web sourcetype=Prod application
|eval Version=if('Version'="3.0", "3.0", "NOT 3.0")
|stats dc(Users) as Unique_Users by Version
|eventstats sum(Unique_Users) as AllUsers
|eval percent= round( Unique_Users/AllUsers)
|appendpipe
[ search index=web sourcetype=Prod application Version="*"
|stats....]

Tags (2)
0 Karma

woodcock
Esteemed Legend

I do not understand why this is insufficient; do explain more:

index=web AND sourcetype=Prod application
|eval Version=if('Version'="3.0", "3.0", "NOT 3.0")
|stats dc(Users) as Unique_Users by Version
|eventstats sum(Unique_Users) AS AllUsers
|eval percent= round(Unique_Users/AllUsers)
0 Karma

khanyag1
New Member

@woodcock it's insufficient because on my line chart, I am not seeing the other versions. I have a line that says from 3.0- Not 3.0. I would like to see the other versions as well.

0 Karma

woodcock
Esteemed Legend

So get rid of that eval line.

0 Karma

khanyag1
New Member

@woodcock I did try this and it didn't work

0 Karma

woodcock
Esteemed Legend

It worked fine for me. Cut and paste from this answer or type it in again. Maybe you have some stray invisible control character in your SPL?

0 Karma

khanyag1
New Member

Thank you, it's still not working. Not sure why it didn't work for me. I removed the append pipe in my original and it's close to what I need for now. I want to further break it down so that the latest version automatically populates on it's own without manual input. Is this possible?

0 Karma

khanyag1
New Member

@somesoni2 I was hoping to see Version and Total Users. I would like 2 different line charts(1 for every version that is not 3.0 and one that is 3.0). Ambitiously, I would also like to separate it by operating system so windows vs mac but I didn't include that in my initial search.

0 Karma

somesoni2
Revered Legend

Can you post some sample output (columns you want to show with sample values)?

0 Karma

khanyag1
New Member

@somesoni2 I was hoping to have the latest version on one line(by total users) and then the other versions on another line(total users) by Operating system(windows/mac). I'm hoping to use a visualization line chart. In my search I didn't include the OS although that's what I want to end up doing.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...

Developer Spotlight with Guilhem Marchand

From Splunk Engineer to Founder: The Journey Behind TrackMe    After spending over 12 years working full time ...

Cisco Catalyst Center Meets Splunk ITSI: From 'Payments Are Down' to Root Cause in ...

The Problem: When Networks and Services Don't Talk Payment systems fail at a retail location. Customers are ...