Reporting

histogram report of purchase amount

andyk
Path Finder

I have events that contains an amount. How do I create a histogram report that counts events grouped into these intervalls:

lt 100

100 – 149

150 – 199

200 – 249

250 – 299

300 – 349

350 – 399

300 – 449

450 – 499

gt 500

Tags (3)
0 Karma
1 Solution

andyk
Path Finder

Just after I wrote the question it came to me, the eval command:

search | eval amount= if(amount < 100, "99", amount) | eval amount= if(amount > 500, "501", amount)| bucket amount span=50 | stats count by amount | sort by amount

Someone with more experiance maybe can check if this is the correct way to do it.

View solution in original post

0 Karma

andyk
Path Finder

Just after I wrote the question it came to me, the eval command:

search | eval amount= if(amount < 100, "99", amount) | eval amount= if(amount > 500, "501", amount)| bucket amount span=50 | stats count by amount | sort by amount

Someone with more experiance maybe can check if this is the correct way to do it.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...