Splunk Search

how to display decline rate per specified fields over a period of time

demkic
Explorer

Hello,

I am struggling to write a query that displays the decline rate per payment_method over a period of 7 days (with span=1d).

Ideally, I would like to display in one graph - a stacked bar chart of total volume of approved and declined transactions, and overlay that with the decline rate per payment_method (where payment method is in the legend) displayed over time (span=1d for 1 week).

base query...
| bin _time span=1d 
| stats count(eval(success="false")) as declined, count(eval(success="true")) as approved, count as total by payment_method _time 
| eval percent_declined=round(declined / total * 100, 1) 
| table _time payment_method approved declined percent_declined 
| eval _time=strftime(_time,"%b %e, %Y") 
| sort -_time

Any help is greatly appreciated.

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

base query...
 | bin _time span=1d 
 | stats count(eval(success="false")) as declined, count(eval(success="true")) as approved, count as total by payment_method _time 
 | eval percent_declined=round(declined / total * 100, 1) 
 | table _time payment_method approved declined percent_declined
 | timechart span=1d max(approved) max(declined) max(percent_declined) by payment_method

View solution in original post

0 Karma

somesoni2
Revered Legend

Try like this

base query...
 | bin _time span=1d 
 | stats count(eval(success="false")) as declined, count(eval(success="true")) as approved, count as total by payment_method _time 
 | eval percent_declined=round(declined / total * 100, 1) 
 | table _time payment_method approved declined percent_declined
 | timechart span=1d max(approved) max(declined) max(percent_declined) by payment_method
0 Karma

demkic
Explorer

ahh I see, thank you! Looks like that did it

0 Karma

cmerriman
Super Champion

what is it showing up as now? The syntax, to me, looks accurate enough. Is _time not showing up properly or are you having trouble formatting the chart, or is it that the fields aren't populated correctly?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...