topic Cohort report ? in Reporting

Cohort report ?

Yarsa — Wed, 22 Aug 2012 09:33:44 GMT

Hi, I'm trying to build a cohort report in splunk and I can't think of an easy way other than a million joins.

Let's say I want to measure retention to my site.
I would take all the users who visited my site on the week of June 5th and see how much of them return in the following weeks.
The same thing I would do for each of the following weeks.

     Week 1| Week 2 | Week 3 |  Week 4 | Week 5  |

June 5 | 100 | 20 | 15 | 10 | 10
June 12 | 110 | 40 | 35 | 30 |
June 19 | 106 | 50 | 44 | |
June 26 | 100 | 55 | | |

I've built a cohort like this with more than 10 different joins and a few appends.

Is there a simpler way?
streamstats perhaps?

thanks

Re: Cohort report ?

Ayn — Wed, 22 Aug 2012 09:50:06 GMT

How do you identify unique users? By cookie value or something else?

Re: Cohort report ?

Yarsa — Wed, 22 Aug 2012 10:36:56 GMT

I have logs like this:
* 2012-08-07T23:36:16+0000 A=enterEvent userId=####### ...

Re: Cohort report ?

Yarsa — Mon, 28 Sep 2020 12:18:38 GMT

Hi turns out it was easier than I thought 🙂
Here's what I did

scheduled job - test#:
"earliest="-4w@w" latest="@w" sourcetype=bi | bucket _time as week span=1w | table userId week"

scheduled job - test##:

"earliest="-4w@w" latest="@w" sourcetype=bi A=enterEvent | bucket _time as week span=1w | convert timeformat="%d/%m/%y" ctime(_time) AS day | stats dc(day) as days by userId,week"

Final query

Thanks!

Re: Cohort report ?

jbranislav — Fri, 14 Aug 2015 13:40:36 GMT

Hi, can you please explain little your search? I'm trying to do similar search but with no luck. Thanks