Splunk Operational Intelligence Cookbook - Third Edition

How to do it...

Follow the steps in this recipe to leverage summary indexing and to backfill the number of purchases by city:

1. Log in to your Splunk server.
2. Select the Operational Intelligence application.
3. From the search bar, enter the following search and select to run over Last 24 hours:

index=main sourcetype=log4j requestType="checkout" | iplocation ipAddress | fillnull value="Unknown" City  | replace "" with "Unknown" in City | stats count AS Purchases by City

4. Splunk should now display the results of the search, similar to the results shown in the following screenshot:

5. Click on the Save As dropdown and select Report from the list: ...