Splunk Search

Use timechart after stats command to show percentage of Successful transaction for each day

Jitendra33
Engager

Hi Team,

 

I am trying to put conversion of transaction for all days of the week in a line chart for successful transaction for multiple merchants . Something  like this shown below.Screenshot 2024-06-13 at 4.17.17 PM.png

 

My query is like this : 

| Myquery
| stats sum(Attempts) as TransactionAttempts, sum(Success) as SuccessfulTransactions by MerchantName
| eval CR= round(coalesce( SuccessfulTransactions / TransactionAttempts * 100, 0 ), 2)
| timechart span=1d CR by MerchantName

 

Which function shall i put in timechart to get desired result

Labels (4)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Jitendra33 ,

after a stats command, you have only the fields listed in the command, in your case you don't have the _time that is rerquested for the timechart command, so use stats, something like this (to adapt to your real case:

| Myquery
| bin span=1d _time
| stats 
     sum(Attempts) AS TransactionAttempts
     sum(Success) AS SuccessfulTransactions 
     BY _time MerchantName
| eval CR=round(SuccessfulTransactions/TransactionAttempts*100, 2)

Why did you used coalesce?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...