topic Re: Drop off count in website. in Splunk Search

Drop off count in website.

sandeepmakkena — Wed, 30 Sep 2020 02:02:58 GMT

I am working on website sales data where n number of different services are called like CartService, OrderBuildService, CheckoutOfferService,ShippingService and WEB_ORDER_RELEASE. I would like to know drop off rate between any two services.
Say order makes from CartService to Web_Order_release is successfully processed order.
Thanks for your time.

Re: Drop off count in website.

richgalloway — Tue, 03 Sep 2019 21:02:04 GMT

This is a two-step process First count the number of events of each service, in process order. Then use streamstats to find the difference in the count between a service and it predecessor.

... | eval sorter = case(service="CartService", 1, service="OrderBuildService", service="CheckoutOfferService", service="ShippingService", service="Web_Order_release", 1==1, "unknown") 
| stats count values(service) as service by sorter
| streamstats window=2 range(count) as dropoff
| table service count dropoff

Re: Drop off count in website.

sandeepmakkena — Tue, 03 Sep 2019 22:07:14 GMT

When I do that, all the stats are going to unknown sorter.

Re: Drop off count in website.

richgalloway — Wed, 30 Sep 2020 02:03:03 GMT

Verify the service names are correct and the field name 'service' is legit.
If that all checks out, try this alternative:

... | eval sorter = case(like(service,"CartService"), 1, like(service,"OrderBuildService"), like(service,"CheckoutOfferService"), like(service,"ShippingService"), like(service,"Web_Order_release"), 1==1, "unknown")
| stats count values(service) as service by sorter
| streamstats window=2 range(count) as dropoff
| table service count dropoff