<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How to use timechart with a calculated field? in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-with-a-calculated-field/m-p/246296#M73431</link>
    <description>&lt;P&gt;I have this search that displays my conversion rate:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;tag=external_traffic  eventtype=pageactions session_id=\*
| transaction session_id startswith=(referrer=/store/category/page)  maxpause=30m mvlist=f
| eval didco = if(match(url, "/checkout/order"), 1, 0 )
| stats sum(didco) as cr , count as sessions by experienceId
| eval conv_rate = cr/sessions
 | table experienceId conv_rate
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;This gives me the conversion rate for the search period, but how can I do this as a daily number?&lt;/P&gt;

&lt;P&gt;Notice the "experienceId" there are 2 experiences on the site, and I want to see the conversion rate for both them on a daily chart. &lt;/P&gt;</description>
    <pubDate>Wed, 11 May 2016 18:52:40 GMT</pubDate>
    <dc:creator>ra01</dc:creator>
    <dc:date>2016-05-11T18:52:40Z</dc:date>
    <item>
      <title>How to use timechart with a calculated field?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-with-a-calculated-field/m-p/246296#M73431</link>
      <description>&lt;P&gt;I have this search that displays my conversion rate:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;tag=external_traffic  eventtype=pageactions session_id=\*
| transaction session_id startswith=(referrer=/store/category/page)  maxpause=30m mvlist=f
| eval didco = if(match(url, "/checkout/order"), 1, 0 )
| stats sum(didco) as cr , count as sessions by experienceId
| eval conv_rate = cr/sessions
 | table experienceId conv_rate
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;This gives me the conversion rate for the search period, but how can I do this as a daily number?&lt;/P&gt;

&lt;P&gt;Notice the "experienceId" there are 2 experiences on the site, and I want to see the conversion rate for both them on a daily chart. &lt;/P&gt;</description>
      <pubDate>Wed, 11 May 2016 18:52:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-with-a-calculated-field/m-p/246296#M73431</guid>
      <dc:creator>ra01</dc:creator>
      <dc:date>2016-05-11T18:52:40Z</dc:date>
    </item>
    <item>
      <title>Re: How to use timechart with a calculated field?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-with-a-calculated-field/m-p/246297#M73432</link>
      <description>&lt;P&gt;Try this&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;.... | bin span=1d _time | chart sum(didco) as cr , count as sessions over _time by experienceId | ...
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Wed, 11 May 2016 19:04:30 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-with-a-calculated-field/m-p/246297#M73432</guid>
      <dc:creator>sundareshr</dc:creator>
      <dc:date>2016-05-11T19:04:30Z</dc:date>
    </item>
    <item>
      <title>Re: How to use timechart with a calculated field?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-with-a-calculated-field/m-p/246298#M73433</link>
      <description>&lt;P&gt;that seems like most of the way there if I replace " | stats sum(didco) as cr , count as sessions by experienceId" with what you wrote.&lt;/P&gt;

&lt;P&gt;The problem is the chart or summary table doesn't show the "conv_rate" field I was trying to calculate. &lt;/P&gt;</description>
      <pubDate>Wed, 11 May 2016 21:05:07 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-with-a-calculated-field/m-p/246298#M73433</guid>
      <dc:creator>ra01</dc:creator>
      <dc:date>2016-05-11T21:05:07Z</dc:date>
    </item>
    <item>
      <title>Re: How to use timechart with a calculated field?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-with-a-calculated-field/m-p/246299#M73434</link>
      <description>&lt;P&gt;You will need to add the &lt;CODE&gt;eval conv_rate=cr/sessions&lt;/CODE&gt;. Do you not get the &lt;CODE&gt;conv_rate&lt;/CODE&gt; if you add it after the chart command.I used the chart command to give you daily totals. &lt;/P&gt;</description>
      <pubDate>Wed, 11 May 2016 21:15:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-with-a-calculated-field/m-p/246299#M73434</guid>
      <dc:creator>sundareshr</dc:creator>
      <dc:date>2016-05-11T21:15:22Z</dc:date>
    </item>
    <item>
      <title>Re: How to use timechart with a calculated field?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-with-a-calculated-field/m-p/246300#M73435</link>
      <description>&lt;P&gt;the conv_rate value doesn't show up on the summary table or the chart. &lt;/P&gt;

&lt;P&gt;I have it as:&lt;BR /&gt;
| bin span=1h _time&lt;BR /&gt;
| chart sum(didco) as cr , count as sessions over _time by experienceId&lt;BR /&gt;
| eval conv_rate = cr/sessions&lt;/P&gt;

&lt;P&gt;I am getting summary info for CR and Sessions, just not the conv_rate&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 09:41:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-with-a-calculated-field/m-p/246300#M73435</guid>
      <dc:creator>ra01</dc:creator>
      <dc:date>2020-09-29T09:41:20Z</dc:date>
    </item>
    <item>
      <title>Re: How to use timechart with a calculated field?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-with-a-calculated-field/m-p/246301#M73436</link>
      <description>&lt;P&gt;What if you add the &lt;CODE&gt;| table experienceId conv_rate&lt;/CODE&gt; Does it show then? &lt;/P&gt;</description>
      <pubDate>Wed, 11 May 2016 22:39:09 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-with-a-calculated-field/m-p/246301#M73436</guid>
      <dc:creator>sundareshr</dc:creator>
      <dc:date>2016-05-11T22:39:09Z</dc:date>
    </item>
  </channel>
</rss>

