here is an example of how you could write an SPL query to search the "sourcetype" field for values that begin with "access_" have a "status" of 200, and an "action" of "purchase", and the use the 'chart' command to count the number of purchases and compute  the sparkling for each product by using the "categoryld" field in a single 'chart' command: