Splunk Search

chart percentage over over item by user

wang
Path Finder

Let say I have a chart that reports the count of what user has purchased what item. I can create a nice table using chart count over item by user.
===== UserA === UserB === UserC
Item X ====1 =======2 ======= 1
Item Y ==== 2 ====== 3 ======= 5

Now I want each row to report not the count, but the percentage, on a per row basis
====UserA UserB UserC
Item X 25% 50% 25%
Item Y 20% 30% 50%

So essentially, I want to chart percentage over over item by user. How do I do that?

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

If you want to know the percentage of item X that was purchased by each user, then do this:

yoursearchhere
| stats count by item user
| eventstats sum(count) as total by item
| eval percentage=round(count*100/total,1)
| xyseries item user percentage

Instead of looking at the percentage by item, you could look at it by user - just switch "user" for "item" in line 3

View solution in original post

lguinn2
Legend

If you want to know the percentage of item X that was purchased by each user, then do this:

yoursearchhere
| stats count by item user
| eventstats sum(count) as total by item
| eval percentage=round(count*100/total,1)
| xyseries item user percentage

Instead of looking at the percentage by item, you could look at it by user - just switch "user" for "item" in line 3

wang
Path Finder

Worked perfectly. Thanks for the quick reply.

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...