How it works...

First, you created a search. Let's break down the search piece by piece:

Search fragment

Description

index=main   sourcetype=log4j requestType="checkout"   

You should be familiar with this search from the recipes in previous chapters. It is used to return events from the application logs. For this search, you just want the checkout requests.

| eval   avg_price=round(total/numberOfItems,2)   

Using the eval command, you calculate the average price per product by taking the total amount spent over the total number of items purchased. You then round the average to two significant digits.

| table   customerId orderId numberOfItems total avg_price   

Using the table command, you return just the fields you want to see ...

Get Splunk Operational Intelligence Cookbook - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.