topic Re: Add count to user journey flow in Splunk App for Web Analytics in Splunk Search

Add count to user journey flow in Splunk App for Web Analytics

JohannesGmelin — Tue, 29 Sep 2020 14:24:14 GMT

Dear Community,

I have a problem. I'm trying to add the count per bar to my user journey flow in "Splunk App for Web Analytics".
At the top at the landing page filter you can see the total count but I want to split it to the different bar's.

It should looks like this: /contentA/contentB/index.xhtml (120)

This is a picture of my user journey flow:

This is my code where I get the data for the diagram:

| tstats summariesonly=t count FROM datamodel=Web WHERE Web.site="$site$" "Web.eventtype"=pageview "Web.http_session_pageviews">1 Web.uri="$landing_page$*" GROUPBY "Web.site","Web.http_session",_time span=1s,"Web.http_referer","Web.uri","Web.http_session_channel"
| rex field=Web.uri mode=sed "$rex_landing_page$"
| rename Web.uri AS to "Web.http_referer" AS from "Web.http_session_channel" AS channel "Web.site" AS site "Web.http_session" AS http_session
| rex field=from "https?://.+?(?<from_path>/[^\\?]+)" 
| rename from_path AS from
| eval from=if(isnull(from),"$site$",from)
| streamstats global=f count AS interaction by http_session 
| eval interaction=interaction-1
| where interaction<=round($limit$/20,0)
| stats list(from) AS from, list(to) AS to,earliest(to) AS landing_page, list(channel) as channel, list(interaction) as interaction by http_session
| search to="$to$" landing_page="$landing_page$"
| eval fields = mvzip(from,mvzip(to,mvzip(interaction,channel)))
| fields http_session fields
| mvexpand fields
| rex field=fields "(?<from>[^\,]+),(?<to>[^\,]+),(?<interaction>[^\,]+),(?<channel>.+)"
| eval from=if(interaction=0, "", from)
| eval from=if("$landing_page$"!="*", "$site$"."$landing_page$", from)
| table http_session from to interaction
| where interaction>=1
| where to!="$landing_page$"
| where to!=from
| stats count by from,to,interaction
| sort interaction,-count,from,to
| streamstats global=f count AS interaction_rank by interaction
| where interaction_rank<=round($limit$/10,0)
| stats sum(count) AS count by from,to
| sort from to count
| head $limit$

I've tried this and inserted it after | rex field=Web.uri mode=sed "$rex_landing_page$" :

| eval Web.uri=Web.uri+" ("+count+")"

But this don't work.

Whats wrong?

Thanks a lot
Johannes

Re: Add count to user journey flow in Splunk App for Web Analytics

cmerriman — Thu, 08 Jun 2017 11:41:31 GMT

just as a quick glance, have you tried:

| eval "Web.uri"='Web.uri'+" ("+count+")"

Re: Add count to user journey flow in Splunk App for Web Analytics

JohannesGmelin — Thu, 08 Jun 2017 12:38:40 GMT

Not working sry 😞

Re: Add count to user journey flow in Splunk App for Web Analytics

JohannesGmelin — Mon, 12 Jun 2017 12:08:29 GMT

The result is always 1 but that cant be the right?

Re: Add count to user journey flow in Splunk App for Web Analytics

cmerriman — Mon, 12 Jun 2017 12:11:24 GMT

have you broken the syntax down to simply just count the web uri to see what it should be? make sure it's all coming in right.

Re: Add count to user journey flow in Splunk App for Web Analytics

JohannesGmelin — Mon, 12 Jun 2017 12:35:36 GMT

I've tried this but can't find a way to deal with this 😕

Re: Add count to user journey flow in Splunk App for Web Analytics

JohannesGmelin — Mon, 12 Jun 2017 12:43:16 GMT

@woodcock Do you have any idea what I can do?

Re: Add count to user journey flow in Splunk App for Web Analytics

woodcock — Mon, 12 Jun 2017 15:48:20 GMT

You can fix this:

| eval Web.uri=Web.uri+" ("+count+")"

With this:

| eval Web.uri=$Web.uri$+" ("+count+")"

Or this:

| eval Web.uri='Web.uri'+" ("+count+")"