calculate and plot the stats for various pages of a journey

[shashank_24]

Hi, I've a weird requirement from one of my stakeholders. So I have this sales application which contains many flows starting with landing page till checkout.

All these pages count and their response time is being logged in my access logs. There is no session ID available in the logs because of reverse proxy and only clientip is available.

What I want to find out is 

• How much time a journey took for a customer
• If there was any time delay during the flow where it was exactly at what page

My sales application pages look like this -

1. Landing page - /products
2. select installation type - /installation
3. direct-debit page - /direct-debit
4. credit check page - /credit-check
5. review basket - /review
6. successful checkout - /checkout/success

I have this base query where i was trying to attempt something but don't know where to start. Let me know if anyone can guide me on this. It will be highly appreciated.

index=myapp_prod sourcetype=ssl_access_combined Method=GET requested_content="/products" OR requested_content="/installation" OR requested_content="/direct-debit" OR requested_content="/credit-check" OR requested_content="/review" OR requested_content="/checkout/success"
| stats count(eval(requested_content LIKE "/products")) as "landing-page"

. 

[to4kawa]

index=myapp_prod sourcetype=ssl_access_combined Method=GET 
| reverse
| streamstats count(eval(searchmatch("/products"))) as sessions by clientip
| stats range(_time) as duration latest(requested_content) as latest_content by sessions clientip
| where latest_content="/checkout/success"

[to4kawa]

Is there an identifiable number, such as a user ID?

[shashank_24]

@to4kawa No just the clientip. Sample event below -

81.96.207.94 - - [10/Dec/2020:23:24:25 +0000] "GET /checkout/success HTTP/1.1" 200 4965 122326 "https://www.myapp.com/join/checkout" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0 Mobile/15E148 Safari/604.1" TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256