Splunk Search

How to show stats count grouped by two fields in a graph?

cseuser
New Member

I have 3 Ticket groups A, B, and C. And multiple users. My system logs every ticket purchased under each ticket group by each user as below. Every ticket purchase will have the below entry and exit log and user name in between.

Entry Ticket system TicketgrpA ticketnbr = 1232424
SalesUser = user1
Exit Ticket system TicketgrpA ticketnbr = 1232424

Entry Ticket system TicketgrpB ticketnbr = 1234353
SalesUser = user1
ExitTicket system TicketgrpB ticketnbr = 1234353

Entry Ticket system TicketgrpC ticketnbr = 1232434
SalesUser = user4
Exit Ticket system TicketgrpC ticketnbr = 1232434

I would like to show in a graph - Number of tickets purchased by each user under each group.
Y axis - Count
X axis - Users grouped by ticketGrp

TKTSYS* will fetch all the event logs - entry, exit and Sales User. I used below query and it is showing under statistics as below but not showing ticketgrp in the graph. counts are showing combined for all ticketgroups for each user. I want to display them so that each ticket group count is shown grouped for each user.

SalesUser ticketgrp Count
user1         A       1
user2         B       2

index=jra_app_events sourcetype=eventing appVersion=TKTSYS  TKTSYS* | transaction startswith="Entry Ticket system " endswith="Exit Ticket system" | eval ticketgrp=case(like(_raw, "%TicketgrpA%"), "A", like(_raw, "%TicketgrpB%"), "B", like(_raw, "%TicketgrpC%"), "C") | stats count by SalesUser, ticketgrp

Any help would highly appreciated. Thanks.

0 Karma
1 Solution

sundareshr
Legend

Try this

.... | chart count over Users by ticketGrp

View solution in original post

sundareshr
Legend

Try this

.... | chart count over Users by ticketGrp

cseuser
New Member

This gave the exact graph I was looking for. Thanks very much.

0 Karma

lguinn2
Legend

Try this

index=jra_app_events sourcetype=eventing appVersion=TKTSYS  TKTSYS* 
| transaction startswith="Entry Ticket system " endswith="Exit Ticket system" 
| eval ticketgrp=case(like(_raw, "%TicketgrpA%"), "A", like(_raw, "%TicketgrpB%"), "B", like(_raw, "%TicketgrpC%"), "C",1==1,"No Match") 
| chart count by SalesUser, ticketgrp

Just use chart instead of stats

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...