Splunk Search

chart percentage over over item by user

wang
Path Finder

Let say I have a chart that reports the count of what user has purchased what item. I can create a nice table using chart count over item by user.
===== UserA === UserB === UserC
Item X ====1 =======2 ======= 1
Item Y ==== 2 ====== 3 ======= 5

Now I want each row to report not the count, but the percentage, on a per row basis
====UserA UserB UserC
Item X 25% 50% 25%
Item Y 20% 30% 50%

So essentially, I want to chart percentage over over item by user. How do I do that?

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

If you want to know the percentage of item X that was purchased by each user, then do this:

yoursearchhere
| stats count by item user
| eventstats sum(count) as total by item
| eval percentage=round(count*100/total,1)
| xyseries item user percentage

Instead of looking at the percentage by item, you could look at it by user - just switch "user" for "item" in line 3

View solution in original post

lguinn2
Legend

If you want to know the percentage of item X that was purchased by each user, then do this:

yoursearchhere
| stats count by item user
| eventstats sum(count) as total by item
| eval percentage=round(count*100/total,1)
| xyseries item user percentage

Instead of looking at the percentage by item, you could look at it by user - just switch "user" for "item" in line 3

wang
Path Finder

Worked perfectly. Thanks for the quick reply.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...