Dashboards & Visualizations

Survival analysis chart

michelhubert
Engager

I want to display a survival probability chart for churn analysis.
Some background info: http://www.data-miners.com/resources/Customer-Insight-Article.pdf

I have index source with tenureday as field.
I can show a harzard chart (total customers per tenureday)

index=customers| chart count by tenureday

But I want to chart the survival probability.
Therefor I have to calculate a cumulative sum divided by total customers per tenureday.

How?

Tags (2)
0 Karma

michelhubert
Engager

I found a way. I don't know if it's the best way:

index=customers | stats count as daycount by tenureday | sort tenureday | accum daycount as cumsum  | eventstats sum(daycount) as totalz | eval srv = 1 - (cumsum / totalz) | fields tenureday, srv

woodcock
Esteemed Legend

I believe this will work:

index=customers | stats count sum(MyFieldName) AS sum BY tenureday | eval calculation=sum/count
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...