Add count to user journey flow in Splunk App for Web Analytics

[JohannesGmelin]

Dear Community,

I have a problem. I'm trying to add the count per bar to my user journey flow in "Splunk App for Web Analytics".
At the top at the landing page filter you can see the total count but I want to split it to the different bar's.

It should looks like this: /contentA/contentB/index.xhtml (120)

This is a picture of my user journey flow:

This is my code where I get the data for the diagram:

| tstats summariesonly=t count FROM datamodel=Web WHERE Web.site="$site$" "Web.eventtype"=pageview "Web.http_session_pageviews">1 Web.uri="$landing_page$*" GROUPBY "Web.site","Web.http_session",_time span=1s,"Web.http_referer","Web.uri","Web.http_session_channel"
| rex field=Web.uri mode=sed "$rex_landing_page$"
| rename Web.uri AS to "Web.http_referer" AS from "Web.http_session_channel" AS channel "Web.site" AS site "Web.http_session" AS http_session
| rex field=from "https?://.+?(?<from_path>/[^\\?]+)" 
| rename from_path AS from
| eval from=if(isnull(from),"$site$",from)
| streamstats global=f count AS interaction by http_session 
| eval interaction=interaction-1
| where interaction<=round($limit$/20,0)
| stats list(from) AS from, list(to) AS to,earliest(to) AS landing_page, list(channel) as channel, list(interaction) as interaction by http_session
| search to="$to$" landing_page="$landing_page$"
| eval fields = mvzip(from,mvzip(to,mvzip(interaction,channel)))
| fields http_session fields
| mvexpand fields
| rex field=fields "(?<from>[^\,]+),(?<to>[^\,]+),(?<interaction>[^\,]+),(?<channel>.+)"
| eval from=if(interaction=0, "", from)
| eval from=if("$landing_page$"!="*", "$site$"."$landing_page$", from)
| table http_session from to interaction
| where interaction>=1
| where to!="$landing_page$"
| where to!=from
| stats count by from,to,interaction
| sort interaction,-count,from,to
| streamstats global=f count AS interaction_rank by interaction
| where interaction_rank<=round($limit$/10,0)
| stats sum(count) AS count by from,to
| sort from to count
| head $limit$

I've tried this and inserted it after | rex field=Web.uri mode=sed "$rex_landing_page$" :

| eval Web.uri=Web.uri+" ("+count+")"

But this don't work.

Whats wrong?

Thanks a lot
Johannes

[woodcock]

You can fix this:

| eval Web.uri=Web.uri+" ("+count+")"

With this:

| eval Web.uri=$Web.uri$+" ("+count+")"

Or this:

| eval Web.uri='Web.uri'+" ("+count+")"

[cmerriman]

just as a quick glance, have you tried:

| eval "Web.uri"='Web.uri'+" ("+count+")"

[JohannesGmelin]

The result is always 1 but that cant be the right?

[cmerriman]

have you broken the syntax down to simply just count the web uri to see what it should be? make sure it's all coming in right.

[JohannesGmelin]

I've tried this but can't find a way to deal with this 😕

[JohannesGmelin]

@woodcock Do you have any idea what I can do?

[JohannesGmelin]

Not working sry 😞