Reporting

histogram report of purchase amount

andyk
Path Finder

I have events that contains an amount. How do I create a histogram report that counts events grouped into these intervalls:

lt 100

100 – 149

150 – 199

200 – 249

250 – 299

300 – 349

350 – 399

300 – 449

450 – 499

gt 500

Tags (3)
0 Karma
1 Solution

andyk
Path Finder

Just after I wrote the question it came to me, the eval command:

search | eval amount= if(amount < 100, "99", amount) | eval amount= if(amount > 500, "501", amount)| bucket amount span=50 | stats count by amount | sort by amount

Someone with more experiance maybe can check if this is the correct way to do it.

View solution in original post

0 Karma

andyk
Path Finder

Just after I wrote the question it came to me, the eval command:

search | eval amount= if(amount < 100, "99", amount) | eval amount= if(amount > 500, "501", amount)| bucket amount span=50 | stats count by amount | sort by amount

Someone with more experiance maybe can check if this is the correct way to do it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...