Splunk Search

How to get top 5 products for each day for 7 days?

nu_learner
Explorer

Hello,
I am new to splunk. I need to get the top 5 products sold for each day, for the last 7 days. The products could be different each day, as shown in the example below.

  Day (X-Axis)
Top 5 Products (Y-Axis) 1 2 3 4 5
1 P1 PA P4 AC ZX
2 P2 PB P5 AR P1
3 P3  PC PA P5 AC
4 P4 P1 P1 P4 AR
5 P5 PD AB AX AB


Is there a way to get it done? I tired the following but it gives me the same 5 products for all days and puts everything else in "OTHER" bucket:

[my search]
| table _time, Product
| timechart count(Product) byProduct WHERE max in top5

Labels (2)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

It kind of depends on how your sales number is obtained, i.e., what kind of data you have.  Suppose you have a feed of each transaction in which one of the field is Product.  You can easily do

| bin _time span=1d@d
| top 5 Product by _time
| eval date = strftime(_time, "%F")
| stats list(Product) by date
| transpose header_field=date
| fields - column

View solution in original post

Tags (1)

nu_learner
Explorer
0 Karma

yuanliu
SplunkTrust
SplunkTrust

It kind of depends on how your sales number is obtained, i.e., what kind of data you have.  Suppose you have a feed of each transaction in which one of the field is Product.  You can easily do

| bin _time span=1d@d
| top 5 Product by _time
| eval date = strftime(_time, "%F")
| stats list(Product) by date
| transpose header_field=date
| fields - column
Tags (1)
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...