Create a basic chart
In this example you compare the counts of user actions by calculating information about the actions customers have taken on the online store website.
- The number of times each product is viewed
- The number of times each product is added to the cart
- The number of times each product is purchased
This example requires the
productName field from the Enabling field lookups section. You must complete all of those steps before continuing with this section. If you do not configure the field lookups, the searches will not produce the correct results.
- Start a new search.
- Set the time range to All time.
- Run the following search.
sourcetype=access_* status=200 | chart count AS views count(eval(action="addtocart")) AS addtocart count(eval(action="purchase")) AS purchases by productName | rename productName AS "Product Name", views AS "Views", addtocart AS "Adds to Cart", purchases AS "Purchases"
This search uses the
chartcommand to count the number of events that are
action=addtocart. The search then uses the
renamecommand to rename the fields that appear in the results.
chartcommand is a transforming command. The results of the search appear on the Statistics tab.
- Click the Visualization tab. The search results appear in a Pie chart.
- Change the display to a Column chart.
Save and share your reports
Create an overlay chart and explore visualization options
This documentation applies to the following versions of Splunk® Enterprise: 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7