Splunk Search

How do I show fastest growing products?

nimmos
Engager

Hello,

I have a shop that sells different kind of products. Usually I have a search to show me the top 10 products sold in the last 24 hours, but some of the products in that list are all-time best-sellers and not so interesting to see (as I already know about those).

How do I get a list of top sold products that, let's say, are trending today (24 hours), but are not global trenders?

Example:

Today the top 10 sold products are:
1-milk*
2-beer*
3-tuna*
4-beef
5-cheese*
6-coffee*
7-bread
8-chicken
9-eggs
10-cereals*

Of those, the starred ones (*) 1, 2, 3, 5, 6, 10 are all-time sellers, so I would be more interested in showing only the not starred ones, which are trending today only:
-beef
-bread
-chicken
-eggs

My idea is to get the top 10 for the last 7 days, and then diff it with the top 10 of last 24 hours, but not sure if this is a good approach for what I want to accomplish, or what time-range to pick to find the all-time sellers.

The general idea is to show only the newcomers to this list of top 10 sold products. Or in other words, the products that are growing faster over a period of time.

Any suggestion?

Thanks a lot!

0 Karma

somesoni2
Revered Legend

Try something like this

Your base search earliest=-14d@d latest=@d [search your  base search earliest=@d latest=now | top 10 product showperc=f | table product | bucket span=1d _time | stats count by product _time | stats avg(count)  as "Last2Weeks" by product | append [search your  base search earliest=@d latest=now | top 10 product showperc=f | rename count as "Today"] | stats values(*) as * by product | where Today>1.25*Last2Week

Basically, get the top 10 products today, find the avg daily count for them in last 2 weeks, and compare them with today's count. My example threshold is 1.25 times (configured yours). The all time best sellers will not show much deviation from the average, so using that assumption for basis of this.

0 Karma

lpolo
Motivator

Can you provide a log sample? So a query could be devise.
Thanks,
Lp

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...