Dashboards & Visualizations

Survival analysis chart


I want to display a survival probability chart for churn analysis.
Some background info: http://www.data-miners.com/resources/Customer-Insight-Article.pdf

I have index source with tenureday as field.
I can show a harzard chart (total customers per tenureday)

index=customers| chart count by tenureday

But I want to chart the survival probability.
Therefor I have to calculate a cumulative sum divided by total customers per tenureday.


Tags (2)
0 Karma


I found a way. I don't know if it's the best way:

index=customers | stats count as daycount by tenureday | sort tenureday | accum daycount as cumsum  | eventstats sum(daycount) as totalz | eval srv = 1 - (cumsum / totalz) | fields tenureday, srv

Esteemed Legend

I believe this will work:

index=customers | stats count sum(MyFieldName) AS sum BY tenureday | eval calculation=sum/count
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...