Splunk Search

Use timechart after stats command to show percentage of Successful transaction for each day

Jitendra33
Engager

Hi Team,

 

I am trying to put conversion of transaction for all days of the week in a line chart for successful transaction for multiple merchants . Something  like this shown below.Screenshot 2024-06-13 at 4.17.17 PM.png

 

My query is like this : 

| Myquery
| stats sum(Attempts) as TransactionAttempts, sum(Success) as SuccessfulTransactions by MerchantName
| eval CR= round(coalesce( SuccessfulTransactions / TransactionAttempts * 100, 0 ), 2)
| timechart span=1d CR by MerchantName

 

Which function shall i put in timechart to get desired result

Labels (4)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Jitendra33 ,

after a stats command, you have only the fields listed in the command, in your case you don't have the _time that is rerquested for the timechart command, so use stats, something like this (to adapt to your real case:

| Myquery
| bin span=1d _time
| stats 
     sum(Attempts) AS TransactionAttempts
     sum(Success) AS SuccessfulTransactions 
     BY _time MerchantName
| eval CR=round(SuccessfulTransactions/TransactionAttempts*100, 2)

Why did you used coalesce?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...