Splunk Search

Abandon Rate

vibhorkhanna
New Member

Hi, I am trying to find the abandonment rate for users who started the registration process but didnt complete it within say the 4 hours. I have the following query (part of an overall dashboard with an inline time range filter). Any help would be appreciated.

P.S. getStarted is the start step and ProcessApplication is the finish step

index=ABC sourcetype=ABC_ASAPI_elilogs Application.Channel=OA "Extended_Fields.SubChannel"= MobileApp Extended_Fields.StepInfo=getStarted NOT Extended_Fields.RegistrationType=NotSpecified | strcat Extended_Fields.AcctType "" Extended_Fields.RegistrationType AcctReg
| stats dc(Extended_Fields.AppId) by AcctReg
| rename dc(Extended_Fields.AppId) as Start
| appendcols
[ search index=ABC sourcetype=ABC_ASAPI_elilogs Application.Channel=OA "Service.Operation"=ProcessApplication "Extended_Fields.SubChannel"= MobileApp | strcat Extended_Fields.AcctType "
" Extended_Fields.RegistrationType AcctReg
| stats dc(Extended_Fields.AppId) by AcctReg
| rename dc(Extended_Fields.AppId) as Finish]
| eval Abandon%=(Start-Finish)/Start*100
| fields AcctReg Abandon% Start Finish | sort - Finish

0 Karma

HiroshiSatoh
Champion

What about using transaction commands?

 index=ABC sourcetype=ABC_ASAPI_elilogs Application.Channel=OA ・・・・・
| strcat Extended_Fields.AcctType "" Extended_Fields.RegistrationType AcctReg
| transaction Extended_Fields.AcctType startswith="getStarted" endswith="ProcessApplication"
| stats count(eval(duration<1441)) as Finish ,count as Start by AcctReg
| eval Abandon%=(Start-Finish)/Start*100
0 Karma

bandit
Motivator
index="main" 
    | stats count as Start by host 
    | appendcols 
        [| search index="main" "error" 
        | stats count as Finish by host ] 
    | fillnull value=0 Finish 
    | eval CompletionPct=(Finish/Start)*100 
    | eval AbandonPct=100-CompletionPct 
    | eval CompletionPct=round(CompletionPct,2) 
    | eval AbandonPct=round(AbandonPct,2) 
    | table host Start Finish CompletionPct AbandonPct
0 Karma

vibhorkhanna
New Member

is this what you have suggested (full query) - I am not getting any result so unsure if it is an format error.

index=sne sourcetype=sne_ASAPI_elilogs Application.Channel=OA "Extended_Fields.SubChannel"=CWP-MobileApp Extended_Fields.StepInfo=getStarted NOT Extended_Fields.RegistrationType=NotSpecified | strcat Extended_Fields.AcctType "" Extended_Fields.RegistrationType AcctReg
| stats dc(Extended_Fields.AppId) by AcctReg as Start by host
| appendcols
[ search index=sne sourcetype=sne_ASAPI_elilogs Application.Channel=OA "Service.Operation"=ProcessApplication "Extended_Fields.SubChannel"=CWP-MobileApp | strcat Extended_Fields.AcctType "
" Extended_Fields.RegistrationType AcctReg
| stats dc(Extended_Fields.AppId) by AcctReg as Finish by host ]
| fillnull value=0 Finish
| eval CompletionPct=(Finish/Start)*100
| eval AbandonPct=100-CompletionPct
| eval CompletionPct=round(CompletionPct,2)
| eval AbandonPct=round(AbandonPct,2)
| table host Start Finish CompletionPct AbandonPct

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...