Splunk Search

how to display decline rate per specified fields over a period of time

demkic
Explorer

Hello,

I am struggling to write a query that displays the decline rate per payment_method over a period of 7 days (with span=1d).

Ideally, I would like to display in one graph - a stacked bar chart of total volume of approved and declined transactions, and overlay that with the decline rate per payment_method (where payment method is in the legend) displayed over time (span=1d for 1 week).

base query...
| bin _time span=1d 
| stats count(eval(success="false")) as declined, count(eval(success="true")) as approved, count as total by payment_method _time 
| eval percent_declined=round(declined / total * 100, 1) 
| table _time payment_method approved declined percent_declined 
| eval _time=strftime(_time,"%b %e, %Y") 
| sort -_time

Any help is greatly appreciated.

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

base query...
 | bin _time span=1d 
 | stats count(eval(success="false")) as declined, count(eval(success="true")) as approved, count as total by payment_method _time 
 | eval percent_declined=round(declined / total * 100, 1) 
 | table _time payment_method approved declined percent_declined
 | timechart span=1d max(approved) max(declined) max(percent_declined) by payment_method

View solution in original post

0 Karma

somesoni2
Revered Legend

Try like this

base query...
 | bin _time span=1d 
 | stats count(eval(success="false")) as declined, count(eval(success="true")) as approved, count as total by payment_method _time 
 | eval percent_declined=round(declined / total * 100, 1) 
 | table _time payment_method approved declined percent_declined
 | timechart span=1d max(approved) max(declined) max(percent_declined) by payment_method
0 Karma

demkic
Explorer

ahh I see, thank you! Looks like that did it

0 Karma

cmerriman
Super Champion

what is it showing up as now? The syntax, to me, looks accurate enough. Is _time not showing up properly or are you having trouble formatting the chart, or is it that the fields aren't populated correctly?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...