Sankey series of urls as steps for a user to complete journey

[johnansett]

Hey all,
I can't figure out how to create a 'journey' for a Sankey diagram. I saw this at Conf and thought it would be perfect for our use case:

In short we have approx ~13 URLS as a user progresses through a purchase of a product - these are individual events and nothing which provides the previous page the clicked within the data. E.g:

[2019-07-09T14:08:33.631+0000] "GET /assets/main.js.gzip?0a3e3012baedc3b75190 HTTP/1.1" 200 0 110273 "https://site.company.com/page1" "Mozilla/5.0 (Linux; Android 7.1.2; E6810) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.101 Mobile Safari/537.36"

[2019-07-09T14:08:25.216+0000] "PUT /api/update HTTP/1.1" 200 3754 3754 "https://site.company.com/page2" "Mozilla/5.0 (Linux; Android 9; SAMSUNG SM-G960U Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/9.0 Chrome/67.0.3396.87 Mobile Safari/537.36"

[2019-07-09T14:08:29.988+0000] "POST /api/someting /HTTP/1.1" 200 2264 8290 "https://site.company.com/page3" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36" 

I know that to get to page 2 you need to have been on page 1 and to get to page 3 you need to be on page 2 and I want to show how many users make it to each page.

Any help is greatly appreciated!

[woodcock]

Check out Splunk's cool new (premium, pay-extra) app for this Business Flow (AKA Journey Analytics😞
https://docs.splunk.com/Documentation/SBF/latest/UserManual/WelcometoSplunkBusinessFlow

[jkat54]

Try this:

 ... | rex field=referer "https?://.*(?<referer_path>/.*)\?.*"  | stats count, avg(bytes) by referer_path uri_path