<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: first 5 pages visited post login in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/first-5-pages-visited-post-login/m-p/326690#M40278</link>
    <description>&lt;P&gt;Here is what I have, the query "works" but I don't think the results are right....&lt;/P&gt;

&lt;P&gt;Here is the query&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; index=wholesale_app buildTarget=blah product=Product1 Activity Properties.index=5
     | sort 0 _time
     | streamstats count AS PageNumVisited BY clientSessionId |convert num(Properties.args{}) as activityvalue|eval activitytype=case(activityvalue == "0", "Home Page", activityvalue == "1", "Rules Page", activityvalue == "2", "History Page",activityvalue == "3", "Settings Page",activityvalue == "4", "Camera Page",activityvalue == "5", "Paring (Manage Devices) Page",activityvalue == "6", "Third-Party Card Page",activityvalue == "7", "Cloud Page",activityvalue == "8", "Custom Page")| search PageNumVisited&amp;lt;=5|top activitytype
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;And here are the results&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;activitytype    count   percent
Settings Page   49  29.166667
Camera Page 49  29.166667
Home Page   42  25.000000
Rules Page  16  9.523810
History Page    12  7.142857
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The thing I would expect is the home page would be #1 as when you login the first place you go is the home page.&lt;/P&gt;</description>
    <pubDate>Mon, 04 Dec 2017 21:23:54 GMT</pubDate>
    <dc:creator>dbcase</dc:creator>
    <dc:date>2017-12-04T21:23:54Z</dc:date>
    <item>
      <title>first 5 pages visited post login</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/first-5-pages-visited-post-login/m-p/326686#M40274</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;I need to display a pie chart of the first 5 pages visited in an app POST login.  Example:  User 1 logs in at 1pm and views the home page and then goes to the settings page, then to the account page, etc etc.&lt;/P&gt;

&lt;P&gt;Below is the query to get the login event&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;index=wholesale_app buildTarget=blah product=product1 analyticType=SessionStart 
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;And this query get the pages visitied&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;index=wholesale_app buildTarget=blah product=product1 Activity Properties.index=5 |convert num(Properties.args{}) as activityvalue|stats values(activityvalue) as activityvalue by clientSessionId|eval activitytype=case(activityvalue == "0", "Home Page", activityvalue == "1", "Rules Page", activityvalue == "2", "History Page",activityvalue == "3", "Settings Page",activityvalue == "4", "Camera Page",activityvalue == "5", "Paring (Manage Devices) Page",activityvalue == "6", "Third-Party Card Page",activityvalue == "7", "Cloud Page",activityvalue == "8", "Custom Page")|stats count by activitytype
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;How can I only get the user activities POST login?&lt;/P&gt;</description>
      <pubDate>Mon, 04 Dec 2017 16:33:43 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/first-5-pages-visited-post-login/m-p/326686#M40274</guid>
      <dc:creator>dbcase</dc:creator>
      <dc:date>2017-12-04T16:33:43Z</dc:date>
    </item>
    <item>
      <title>Re: first 5 pages visited post login</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/first-5-pages-visited-post-login/m-p/326687#M40275</link>
      <description>&lt;PRE&gt;&lt;CODE&gt;index=wholesale_app buildTarget=blah product=product1 Activity Properties.index=5
| sort 0 _time
| streamstats count AS PageNumVisited BY clientSessionId
| search PageNumVisited&amp;lt;=5
| top activitytype
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;What's happening here:&lt;BR /&gt;
- Sorting the events by _time, increasing (oldest events first)&lt;BR /&gt;
- Using streamstats to tag the event with the order in which it was visited (the first page will get 1, the second page will get 2, etc.)&lt;BR /&gt;
- Filtering out pages beyond the first five&lt;BR /&gt;
- Using top to see the top pages visited after filtering out anything beyond the first 5&lt;/P&gt;</description>
      <pubDate>Mon, 04 Dec 2017 17:44:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/first-5-pages-visited-post-login/m-p/326687#M40275</guid>
      <dc:creator>doweaver</dc:creator>
      <dc:date>2017-12-04T17:44:32Z</dc:date>
    </item>
    <item>
      <title>Re: first 5 pages visited post login</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/first-5-pages-visited-post-login/m-p/326688#M40276</link>
      <description>&lt;P&gt;ah yea that would probably be helpful &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;  yes it is clientSessionID&lt;/P&gt;

&lt;P&gt;Looking at your query that would get pages visited but not necessarily the first 5 pages post login, correct?&lt;/P&gt;</description>
      <pubDate>Mon, 04 Dec 2017 17:50:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/first-5-pages-visited-post-login/m-p/326688#M40276</guid>
      <dc:creator>dbcase</dc:creator>
      <dc:date>2017-12-04T17:50:32Z</dc:date>
    </item>
    <item>
      <title>Re: first 5 pages visited post login</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/first-5-pages-visited-post-login/m-p/326689#M40277</link>
      <description>&lt;P&gt;Oh! I meant "streamstats", not "eventstats". Updating my original answer (and to incorporate the sessioni identifier)&lt;/P&gt;

&lt;P&gt;What that will do is "count" the pages post login, so the first page they visit will be the first event for that clientSessionId, and will get PageNumVisited set to 1, the second set to 2, etc. By filtering out anything above 5, you should filter out the sixth pages visited and beyond.&lt;/P&gt;</description>
      <pubDate>Mon, 04 Dec 2017 17:56:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/first-5-pages-visited-post-login/m-p/326689#M40277</guid>
      <dc:creator>doweaver</dc:creator>
      <dc:date>2017-12-04T17:56:29Z</dc:date>
    </item>
    <item>
      <title>Re: first 5 pages visited post login</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/first-5-pages-visited-post-login/m-p/326690#M40278</link>
      <description>&lt;P&gt;Here is what I have, the query "works" but I don't think the results are right....&lt;/P&gt;

&lt;P&gt;Here is the query&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; index=wholesale_app buildTarget=blah product=Product1 Activity Properties.index=5
     | sort 0 _time
     | streamstats count AS PageNumVisited BY clientSessionId |convert num(Properties.args{}) as activityvalue|eval activitytype=case(activityvalue == "0", "Home Page", activityvalue == "1", "Rules Page", activityvalue == "2", "History Page",activityvalue == "3", "Settings Page",activityvalue == "4", "Camera Page",activityvalue == "5", "Paring (Manage Devices) Page",activityvalue == "6", "Third-Party Card Page",activityvalue == "7", "Cloud Page",activityvalue == "8", "Custom Page")| search PageNumVisited&amp;lt;=5|top activitytype
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;And here are the results&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;activitytype    count   percent
Settings Page   49  29.166667
Camera Page 49  29.166667
Home Page   42  25.000000
Rules Page  16  9.523810
History Page    12  7.142857
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The thing I would expect is the home page would be #1 as when you login the first place you go is the home page.&lt;/P&gt;</description>
      <pubDate>Mon, 04 Dec 2017 21:23:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/first-5-pages-visited-post-login/m-p/326690#M40278</guid>
      <dc:creator>dbcase</dc:creator>
      <dc:date>2017-12-04T21:23:54Z</dc:date>
    </item>
    <item>
      <title>Re: first 5 pages visited post login</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/first-5-pages-visited-post-login/m-p/326691#M40279</link>
      <description>&lt;P&gt;I'm not clear how the query is performing the below&lt;/P&gt;

&lt;P&gt;User 1 logs in then goes to the first 5 pages&lt;/P&gt;

&lt;P&gt;vs&lt;/P&gt;

&lt;P&gt;User 1 has logged in already and we are collecting the pages he / she has visited during the session&lt;/P&gt;</description>
      <pubDate>Mon, 04 Dec 2017 21:25:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/first-5-pages-visited-post-login/m-p/326691#M40279</guid>
      <dc:creator>dbcase</dc:creator>
      <dc:date>2017-12-04T21:25:40Z</dc:date>
    </item>
    <item>
      <title>Re: first 5 pages visited post login</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/first-5-pages-visited-post-login/m-p/326692#M40280</link>
      <description>&lt;BLOCKQUOTE&gt;
&lt;P&gt;User 1 has logged in already and we are collecting the pages he / she has visited during the session&lt;/P&gt;
&lt;/BLOCKQUOTE&gt;

&lt;P&gt;I didn't realize this was a possible distinction. Someone can save their login, or something, so they can have a new session without logging in?&lt;/P&gt;</description>
      <pubDate>Mon, 04 Dec 2017 22:26:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/first-5-pages-visited-post-login/m-p/326692#M40280</guid>
      <dc:creator>doweaver</dc:creator>
      <dc:date>2017-12-04T22:26:13Z</dc:date>
    </item>
    <item>
      <title>Re: first 5 pages visited post login</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/first-5-pages-visited-post-login/m-p/326693#M40281</link>
      <description>&lt;P&gt;Sorry no, lemme try to explain better&lt;/P&gt;

&lt;P&gt;Lets say we want to run this query for the last 24 hours  (from 9 am yesterday to 9am today)&lt;/P&gt;

&lt;P&gt;If someone logged in at 8:45am yesterday and was going from page to page for 1 hour, we wouldn't see the login (since it happened before our time window) but we would see the pages the user went to from 9am to 9:45 am.  Those pages would not be one of the first five they went to and since we didn't see the login event they should be excluded.&lt;/P&gt;

&lt;P&gt;Does that help?&lt;/P&gt;

&lt;P&gt;I've been thinking about this and I think we need to proceed something like the below pseudo code&lt;/P&gt;

&lt;P&gt;Run a query that gets the login event and capture the clientSessionID&lt;BR /&gt;
Then use the list of clientSessionIDs to query for the first 5 pages visited&lt;/P&gt;

&lt;P&gt;Does that make sense?&lt;/P&gt;</description>
      <pubDate>Tue, 05 Dec 2017 15:53:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/first-5-pages-visited-post-login/m-p/326693#M40281</guid>
      <dc:creator>dbcase</dc:creator>
      <dc:date>2017-12-05T15:53:32Z</dc:date>
    </item>
    <item>
      <title>Re: first 5 pages visited post login</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/first-5-pages-visited-post-login/m-p/326694#M40282</link>
      <description>&lt;P&gt;finally figured it out&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;index=wholesale_app buildTarget=* product=* Activity Properties.index=5 [search index=wholesale_app buildTarget=* product=* analyticType=SessionStart|dedup clientSessionId|table clientSessionId]| convert num(Properties.args{}) as activityvalue|sort 0 _time
 | streamstats count AS PageNumVisited BY clientSessionId

 |eval activitytype=case(activityvalue == "1", "Rules Page", activityvalue == "2", "History Page",activityvalue == "3", "Settings Page",activityvalue == "4", "Camera Page",activityvalue == "5", "Paring (Manage Devices) Page",activityvalue == "6", "Third-Party Card Page",activityvalue == "7", "Cloud Page",activityvalue == "8", "Custom Page")
 | stats count by activitytype
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Fri, 08 Dec 2017 17:26:10 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/first-5-pages-visited-post-login/m-p/326694#M40282</guid>
      <dc:creator>dbcase</dc:creator>
      <dc:date>2017-12-08T17:26:10Z</dc:date>
    </item>
  </channel>
</rss>

