Path Analytics

[HeinzWaescher]

Hi,
I would like to analyse the payment paths for my users in Splunk.
For instance:

For how many users was "Product A" the very first purchase? Additional questions for this group of users would be

• How many of these users didn't buy another product afterwards?
• How many of these users bought Product B afterwards (second purchase)?

• How many of these users bought Product C afterwards (second purchase)?

• How many of the users whose second purchase was Product B, didn't make a third pruchase?
  - How many of the users whose second purchase was Product B bought Product C afterwards (third purchase)?

I hope this explains my goal.

Is there a way to do this kind of analysis in Splunk?

Thanks for your input,
Heinz

[kristian_kolb · Accepted solution]

Perhaps you could have a look at transactions. Without proper event data, it's a bit hard to give specific advice, but perhaps something along the lines of;

General search for paths:

search for purchase events | transaction userID mvlist=product | eval path=mvjoin(product, " -> " | top path

Second purchase based on a particular first purchase:

search for purchase events | transaction userID mvlist=product | where mvindex(product,0)=="product_A" | eval second_purchase = mvindex(product,1) | top second_purchase

Ratio of customers whose second purchase is b with no subsequent purchases;

search for purchase events | transaction userID mvlist=product | where mvindex(product,1)=="product_B" | stats c as total c(eval(eventcount=2)) as b_is_last | eval ratio = b_is_last / total 

Hope this helps,

K

[HeinzWaescher]

Hi Kristian,

I've adjusted your ideas to my dataset and tried out some usecases. The results are always the same as in the approach I've described above. So both ways seem to be fine and now my only "problem" is to evaluate which one I want to use 🙂

Thanks a lot

[HeinzWaescher]

The approach I'm trying out at the moment looks like this:

mysearch for all purchase events
| sort 0 + _time
| streamstats count AS Eventserial by user

| eventstats values(eval(if(Eventserial=1, product, null()))) AS Event1, values(eval(if(Eventserial=2, product, null()))) AS Event2, values(eval(if(Eventserial=3, product, null()))) AS Event3, values(eval(if(Eventserial=4, product, null()))) AS Event4 by user

| fillnull value=N/A Event1 Event2 Event3 Event4
| stats dc(user) AS Users by Event1, Event2, Event3, Event4

This would have to be exported in excel and prepared in a Pivottable