Dashboards & Visualizations

Survival analysis chart

michelhubert
Engager

I want to display a survival probability chart for churn analysis.
Some background info: http://www.data-miners.com/resources/Customer-Insight-Article.pdf

I have index source with tenureday as field.
I can show a harzard chart (total customers per tenureday)

index=customers| chart count by tenureday

But I want to chart the survival probability.
Therefor I have to calculate a cumulative sum divided by total customers per tenureday.

How?

Tags (2)
0 Karma

michelhubert
Engager

I found a way. I don't know if it's the best way:

index=customers | stats count as daycount by tenureday | sort tenureday | accum daycount as cumsum  | eventstats sum(daycount) as totalz | eval srv = 1 - (cumsum / totalz) | fields tenureday, srv

woodcock
Esteemed Legend

I believe this will work:

index=customers | stats count sum(MyFieldName) AS sum BY tenureday | eval calculation=sum/count
0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...