Create a basic chart
In this example you compare the counts of user actions by calculating information about the actions customers have taken on the online store website.
- The number of times each product is viewed
- The number of times each product is added to the cart
- The number of times each product is purchased
Prerequisite
This example requires the productName
field from the Enabling field lookups section. You must complete all of those steps before continuing with this section. If you do not configure the field lookups, the searches will not produce the correct results.
Steps
- Start a new search.
- Set the time range to All time.
- Run the following search.
sourcetype=access_* status=200 | chart count AS views count(eval(action="addtocart")) AS addtocart count(eval(action="purchase")) AS purchases by productName | rename productName AS "Product Name", views AS "Views", addtocart AS "Adds to Cart", purchases AS "Purchases"
This search uses thechart
command to count the number of events that areaction=purchase
andaction=addtocart
. The search then uses therename
command to rename the fields that appear in the results.
Thechart
command is a transforming command. The results of the search appear on the Statistics tab.
- Click the Visualization tab. The search results appear in a Pie chart.
- Change the display to a Column chart.
Next step
Create an overlay chart and explore visualization options
See also
chart command in the Search Reference
rename command in the Search Reference
Transforming commands in the Search Manual
Save and share your reports | Create an overlay chart and explore visualization options |
This documentation applies to the following versions of Splunk® Enterprise: 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.3.0, 9.3.1, 9.3.2, 9.4.0
Feedback submitted, thanks!