Splunk Search

Comparing appVersions over time

New Member

Hi, I am trying to compare my latest app vs all the other app Version to evaluate adoption rate. I would like to display this is a visual format

This is my search so far:
index=web sourcetype=Prod application
|eval Version=if('Version'="3.0", "3.0", "NOT 3.0")
|stats dc(Users) as Unique_Users by Version
|eventstats sum(Unique_Users) as AllUsers
|eval percent= round( Unique_Users/AllUsers)
|appendpipe
[ search index=web sourcetype=Prod application Version="*"
|stats....]

Tags (2)
0 Karma

Esteemed Legend

I do not understand why this is insufficient; do explain more:

index=web AND sourcetype=Prod application
|eval Version=if('Version'="3.0", "3.0", "NOT 3.0")
|stats dc(Users) as Unique_Users by Version
|eventstats sum(Unique_Users) AS AllUsers
|eval percent= round(Unique_Users/AllUsers)
0 Karma

New Member

@woodcock it's insufficient because on my line chart, I am not seeing the other versions. I have a line that says from 3.0- Not 3.0. I would like to see the other versions as well.

0 Karma

Esteemed Legend

So get rid of that eval line.

0 Karma

New Member

@woodcock I did try this and it didn't work

0 Karma

Esteemed Legend

It worked fine for me. Cut and paste from this answer or type it in again. Maybe you have some stray invisible control character in your SPL?

0 Karma

New Member

Thank you, it's still not working. Not sure why it didn't work for me. I removed the append pipe in my original and it's close to what I need for now. I want to further break it down so that the latest version automatically populates on it's own without manual input. Is this possible?

0 Karma

New Member

@somesoni2 I was hoping to see Version and Total Users. I would like 2 different line charts(1 for every version that is not 3.0 and one that is 3.0). Ambitiously, I would also like to separate it by operating system so windows vs mac but I didn't include that in my initial search.

0 Karma

Revered Legend

Can you post some sample output (columns you want to show with sample values)?

0 Karma

New Member

@somesoni2 I was hoping to have the latest version on one line(by total users) and then the other versions on another line(total users) by Operating system(windows/mac). I'm hoping to use a visualization line chart. In my search I didn't include the OS although that's what I want to end up doing.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!