I would like to analyse the payment paths for my users in Splunk.
For how many users was "Product A" the very first purchase? Additional questions for this group of users would be
How many of these users bought Product C afterwards (second purchase)?
How many of the users whose second purchase was Product B, didn't make a third pruchase?
- How many of the users whose second purchase was Product B bought Product C afterwards (third purchase)?
I hope this explains my goal.
Is there a way to do this kind of analysis in Splunk?
Thanks for your input,
The approach I'm trying out at the moment looks like this:
mysearch for all purchase events
| sort 0 + _time
| streamstats count AS Eventserial by user
| eventstats values(eval(if(Eventserial=1, product, null()))) AS Event1, values(eval(if(Eventserial=2, product, null()))) AS Event2, values(eval(if(Eventserial=3, product, null()))) AS Event3, values(eval(if(Eventserial=4, product, null()))) AS Event4 by user
| fillnull value=N/A Event1 Event2 Event3 Event4
| stats dc(user) AS Users by Event1, Event2, Event3, Event4
This would have to be exported in excel and prepared in a Pivottable
Perhaps you could have a look at
transactions. Without proper event data, it's a bit hard to give specific advice, but perhaps something along the lines of;
General search for paths:
search for purchase events | transaction userID mvlist=product | eval path=mvjoin(product, " -> " | top path
Second purchase based on a particular first purchase:
search for purchase events | transaction userID mvlist=product | where mvindex(product,0)=="product_A" | eval second_purchase = mvindex(product,1) | top second_purchase
Ratio of customers whose second purchase is b with no subsequent purchases;
search for purchase events | transaction userID mvlist=product | where mvindex(product,1)=="product_B" | stats c as total c(eval(eventcount=2)) as b_is_last | eval ratio = b_is_last / total
Hope this helps,
I've adjusted your ideas to my dataset and tried out some usecases. The results are always the same as in the approach I've described above. So both ways seem to be fine and now my only "problem" is to evaluate which one I want to use 🙂
Thanks a lot