Sum and table results from same field into 2 groups

[davidoking]

Hi,

I have a few fields  and I am trying to get results on  e.g. Field1 (Person) Field2(Sales) Field3 (Location). 

what I am trying to do is somehow Sum(Sales) as Sales by Person (easy part), however I need to separate the location where sales came from e.g. Vic and Other State  and table the total result for each location per person. 

Person    Vic               Other 

Bob           $XX               $XX  

Mary         $xx                $XX

Phil            $XX              $XX

Thoughts? and thank you in advance

[scelikok]

Hi @davidoking,

This may happen is Location for Victoria is not exactly "Vic", if it is "Victoria" you should update if statement accordingly.

[scelikok]

Hi @davidoking,

You can use chart command like below to limit results for only one location;

| chart sum(Sales) as Sales over Person by Location limit=1 usenull=f

 If you want to Vic and others, you can use below;

| eval Location=if(Location!="Vic","Other",Location)
| chart sum(Sales) as Sales over Person by Location usenull=f

[davidoking]

Thanks again, 

almost I almost got it, for some reason it only has Person and Other as columns, results from Vic are not showing, I used the second option. 

Just to confirm "Other" is just any sales that's not from Victoria. so I need to display Vic Sales Vs Sales from everywhere else from each Person. 

[davidoking]

Thanks, I will give that a try. Appreciate the response

[davidoking]

Side note, I was hope it was as simple as If Location (Vic) then Sum(sales) else ... however I don't believe splunk handles IF THEN ELSE statements.