Splunk Search

Comparing appVersions over time

khanyag1
New Member

Hi, I am trying to compare my latest app vs all the other app Version to evaluate adoption rate. I would like to display this is a visual format

This is my search so far:
index=web sourcetype=Prod application
|eval Version=if('Version'="3.0", "3.0", "NOT 3.0")
|stats dc(Users) as Unique_Users by Version
|eventstats sum(Unique_Users) as AllUsers
|eval percent= round( Unique_Users/AllUsers)
|appendpipe
[ search index=web sourcetype=Prod application Version="*"
|stats....]

Tags (2)
0 Karma

woodcock
Esteemed Legend

I do not understand why this is insufficient; do explain more:

index=web AND sourcetype=Prod application
|eval Version=if('Version'="3.0", "3.0", "NOT 3.0")
|stats dc(Users) as Unique_Users by Version
|eventstats sum(Unique_Users) AS AllUsers
|eval percent= round(Unique_Users/AllUsers)
0 Karma

khanyag1
New Member

@woodcock it's insufficient because on my line chart, I am not seeing the other versions. I have a line that says from 3.0- Not 3.0. I would like to see the other versions as well.

0 Karma

woodcock
Esteemed Legend

So get rid of that eval line.

0 Karma

khanyag1
New Member

@woodcock I did try this and it didn't work

0 Karma

woodcock
Esteemed Legend

It worked fine for me. Cut and paste from this answer or type it in again. Maybe you have some stray invisible control character in your SPL?

0 Karma

khanyag1
New Member

Thank you, it's still not working. Not sure why it didn't work for me. I removed the append pipe in my original and it's close to what I need for now. I want to further break it down so that the latest version automatically populates on it's own without manual input. Is this possible?

0 Karma

khanyag1
New Member

@somesoni2 I was hoping to see Version and Total Users. I would like 2 different line charts(1 for every version that is not 3.0 and one that is 3.0). Ambitiously, I would also like to separate it by operating system so windows vs mac but I didn't include that in my initial search.

0 Karma

somesoni2
Revered Legend

Can you post some sample output (columns you want to show with sample values)?

0 Karma

khanyag1
New Member

@somesoni2 I was hoping to have the latest version on one line(by total users) and then the other versions on another line(total users) by Operating system(windows/mac). I'm hoping to use a visualization line chart. In my search I didn't include the OS although that's what I want to end up doing.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...