Something like this -
index=cat sourcetype=ctap host=sc58lcatp* source="*.out" cat_userid="*"
(cat_click="ZIP_SEARCH" OR cat_click="COMPARE" OR cat_click="COMPETITIVE_INFO")
| stats count as clickCount by cat_userid cat_role cat_click
| eval SalesChannel=case(cat_role=="CARESALES","Careretention",
cat_role=="STORESALES","StoreChannel",
cat_role=="SUPERUSER","SuperChannel",
true(),"DefaultChannel")
| eval Uses=if(cat_click=="ZIP_SEARCH",clickCount,0)
| eval Compare=if(cat_click=="COMPARE",clickCount,0)
| eval GetGlossary=if(cat_click=="COMPETITIVE_INFO",clickCount,0)
| stats Sum(Uses) as Uses, sum(Compare) as Compare, sum(GetGlossary) as GetGlossary by cat_userid, SalesChannel
I've assumed, since your code was already getting cat_click somewhere, that it was already defined to splunk, so it could be used in the search.
You'll need to modify the SalesChannel case statement to your actual channel names, assuming that's how you get the channel.
... View more