All Apps and Add-ons

Sankey series of urls as steps for a user to complete journey


Hey all,
I can't figure out how to create a 'journey' for a Sankey diagram. I saw this at Conf and thought it would be perfect for our use case:

alt text

In short we have approx ~13 URLS as a user progresses through a purchase of a product - these are individual events and nothing which provides the previous page the clicked within the data. E.g:

[2019-07-09T14:08:33.631+0000] "GET /assets/main.js.gzip?0a3e3012baedc3b75190 HTTP/1.1" 200 0 110273 "" "Mozilla/5.0 (Linux; Android 7.1.2; E6810) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.101 Mobile Safari/537.36"

[2019-07-09T14:08:25.216+0000] "PUT /api/update HTTP/1.1" 200 3754 3754 "" "Mozilla/5.0 (Linux; Android 9; SAMSUNG SM-G960U Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/9.0 Chrome/67.0.3396.87 Mobile Safari/537.36"

[2019-07-09T14:08:29.988+0000] "POST /api/someting /HTTP/1.1" 200 2264 8290 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36" 

I know that to get to page 2 you need to have been on page 1 and to get to page 3 you need to be on page 2 and I want to show how many users make it to each page.

Any help is greatly appreciated!

0 Karma

Esteemed Legend

Check out Splunk's cool new (premium, pay-extra) app for this Business Flow (AKA Journey Analytics😞

0 Karma


Try this:

 ... | rex field=referer "https?://.*(?<referer_path>/.*)\?.*"  | stats count, avg(bytes) by referer_path uri_path 
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!