Splunk Search

How to aggregate across columns?

Engager

So I currently have a csv table of users and click events related to purchases on an app. The table goes something like this:

userId | timestamp | uxID | buyId | price
1004 5/26/2016 3:36:54 PM 6004 2 5
1300 5/26/2016 5:06:54 PM 6005 1 10
1027 5/26/2016 6:06:54 PM 6006 3 3
...

The buyId is the number of the specific item that users can purchase and there are six items available in total. The price for the different items vary as well. What I want to know is:

1) how much money was spent in total for each item?
2) the total amount of money spent by the top ten users (ranked by how much money they spent

Many thanks!

0 Karma
1 Solution

Super Champion

I think you'll need two separate searches.

...|stats sum(price)  as revenue by buyId

...|stats sum(price) as revenue by userId|sort 0 - revenue |head 10

View solution in original post

Super Champion

I think you'll need two separate searches.

...|stats sum(price)  as revenue by buyId

...|stats sum(price) as revenue by userId|sort 0 - revenue |head 10

View solution in original post

Engager

Thanks very much!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!