Splunk Operational Intelligence Cookbook - Third Edition

How to do it...

Follow these steps to leverage summary indexing in calculating an hourly count of sessions versus the completed transactions:

1. Log in to your Splunk server.
2. Select the Operational Intelligence application.
3. From the search bar, enter the following search and select to run over Last 60 Minutes:

index=main sourcetype=log4j | stats dc(sessionId) AS  Sessions, count(eval(requestType="checkout")) AS  Completed_Transactions

4. Splunk should now display results similar to the following:

5. Click on the Save As dropdown and select Report from the list:

6. In the pop-up box that gets displayed, enter cp09_sessions_transactions_summary ...