I want to display a survival probability chart for churn analysis. Some background info: http://www.data-miners.com/resources/Customer-Insight-Article.pdf
I have index source with tenureday as field. I can show a harzard chart (total customers per tenureday)
index=customers| chart count by tenureday
But I want to chart the survival probability. Therefor I have to calculate a cumulative sum divided by total customers per tenureday.
How?
I found a way. I don't know if it's the best way:
index=customers | stats count as daycount by tenureday | sort tenureday | accum daycount as cumsum | eventstats sum(daycount) as totalz | eval srv = 1 - (cumsum / totalz) | fields tenureday, srv
I believe this will work:
index=customers | stats count sum(MyFieldName) AS sum BY tenureday | eval calculation=sum/count
