Hi
I am new to splunk and still exploring it.
How do i create a new result set after performing some calculation on existing stats output ?
More details here:
There can be multiple stores and each store can create multiple deals.
I was able to get total deals per store id using this query
index=fosign
env="test"
Level="Information"
Properties.DealJacketId=*
Properties.StoreId=*
Properties.LogSource="Create.NewDeal.Handler"
| stats count(Properties.DealJacketId) as "total_deals (In selected time period)" by Properties.StoreId
but I am finding it difficult to produce average deals per day, dynamically based on selected time frame.
Note: User can select multiple time frames and this needs to work for all time frames selected.
StoreId | total_deals (In selected time period) | average_deals_per_day (includes weekend) ==> "need help for this column"
S1234 100 12
S1234 200 15
.
.
.
Sample log:
{
Level: Information
MessageTemplate: Deal created successfully for store: {storeId}, deal id: {DealJacketId}, DealNumber: {DealNumber}
Properties: {
CorrelationId: No Correlation Id Provided
DealJacketId: MTc1ODY2MDAwMDAwMDAwMDAyfDcyMjN8bmp3OUVZQkZ6Sw==
DealNumber: 7223
LogSource: Create.NewDeal.Handler
SourceContext: CreatingNewDeal
}
Timestamp: 2017-12-01T09:20:08.7158876+00:00
}
Any help is appreciated. Thank you.
... View more
