Abandon Rate

[vibhorkhanna]

Hi, I am trying to find the abandonment rate for users who started the registration process but didnt complete it within say the 4 hours. I have the following query (part of an overall dashboard with an inline time range filter). Any help would be appreciated.

P.S. getStarted is the start step and ProcessApplication is the finish step

index=ABC sourcetype=ABC_ASAPI_elilogs Application.Channel=OA "Extended_Fields.SubChannel"= MobileApp Extended_Fields.StepInfo=getStarted NOT Extended_Fields.RegistrationType=NotSpecified | strcat Extended_Fields.AcctType "" Extended_Fields.RegistrationType AcctReg
| stats dc(Extended_Fields.AppId) by AcctReg
| rename dc(Extended_Fields.AppId) as Start
| appendcols
[ search index=ABC sourcetype=ABC_ASAPI_elilogs Application.Channel=OA "Service.Operation"=ProcessApplication "Extended_Fields.SubChannel"= MobileApp | strcat Extended_Fields.AcctType "" Extended_Fields.RegistrationType AcctReg
| stats dc(Extended_Fields.AppId) by AcctReg
| rename dc(Extended_Fields.AppId) as Finish]
| eval Abandon%=(Start-Finish)/Start*100
| fields AcctReg Abandon% Start Finish | sort - Finish

[HiroshiSatoh]

What about using transaction commands?

 index=ABC sourcetype=ABC_ASAPI_elilogs Application.Channel=OA ･････
| strcat Extended_Fields.AcctType "" Extended_Fields.RegistrationType AcctReg
| transaction Extended_Fields.AcctType startswith="getStarted" endswith="ProcessApplication"
| stats count(eval(duration<1441)) as Finish ,count as Start by AcctReg
| eval Abandon%=(Start-Finish)/Start*100

[bandit]

index="main" 
    | stats count as Start by host 
    | appendcols 
        [| search index="main" "error" 
        | stats count as Finish by host ] 
    | fillnull value=0 Finish 
    | eval CompletionPct=(Finish/Start)*100 
    | eval AbandonPct=100-CompletionPct 
    | eval CompletionPct=round(CompletionPct,2) 
    | eval AbandonPct=round(AbandonPct,2) 
    | table host Start Finish CompletionPct AbandonPct

[vibhorkhanna]

is this what you have suggested (full query) - I am not getting any result so unsure if it is an format error.

index=sne sourcetype=sne_ASAPI_elilogs Application.Channel=OA "Extended_Fields.SubChannel"=CWP-MobileApp Extended_Fields.StepInfo=getStarted NOT Extended_Fields.RegistrationType=NotSpecified | strcat Extended_Fields.AcctType "" Extended_Fields.RegistrationType AcctReg
| stats dc(Extended_Fields.AppId) by AcctReg as Start by host
| appendcols
[ search index=sne sourcetype=sne_ASAPI_elilogs Application.Channel=OA "Service.Operation"=ProcessApplication "Extended_Fields.SubChannel"=CWP-MobileApp | strcat Extended_Fields.AcctType "" Extended_Fields.RegistrationType AcctReg
| stats dc(Extended_Fields.AppId) by AcctReg as Finish by host ]
| fillnull value=0 Finish
| eval CompletionPct=(Finish/Start)*100
| eval AbandonPct=100-CompletionPct
| eval CompletionPct=round(CompletionPct,2)
| eval AbandonPct=round(AbandonPct,2)
| table host Start Finish CompletionPct AbandonPct