Splunk Search
Highlighted

Add count to user journey flow in Splunk App for Web Analytics

Path Finder

Dear Community,

I have a problem. I'm trying to add the count per bar to my user journey flow in "Splunk App for Web Analytics".
At the top at the landing page filter you can see the total count but I want to split it to the different bar's.

It should looks like this: /contentA/contentB/index.xhtml (120)

This is a picture of my user journey flow:

alt text

This is my code where I get the data for the diagram:

| tstats summariesonly=t count FROM datamodel=Web WHERE Web.site="$site$" "Web.eventtype"=pageview "Web.http_session_pageviews">1 Web.uri="$landing_page$*" GROUPBY "Web.site","Web.http_session",_time span=1s,"Web.http_referer","Web.uri","Web.http_session_channel"
| rex field=Web.uri mode=sed "$rex_landing_page$"
| rename Web.uri AS to "Web.http_referer" AS from "Web.http_session_channel" AS channel "Web.site" AS site "Web.http_session" AS http_session
| rex field=from "https?://.+?(?<from_path>/[^\\?]+)" 
| rename from_path AS from
| eval from=if(isnull(from),"$site$",from)
| streamstats global=f count AS interaction by http_session 
| eval interaction=interaction-1
| where interaction<=round($limit$/20,0)
| stats list(from) AS from, list(to) AS to,earliest(to) AS landing_page, list(channel) as channel, list(interaction) as interaction by http_session
| search to="$to$" landing_page="$landing_page$"
| eval fields = mvzip(from,mvzip(to,mvzip(interaction,channel)))
| fields http_session fields
| mvexpand fields
| rex field=fields "(?<from>[^\,]+),(?<to>[^\,]+),(?<interaction>[^\,]+),(?<channel>.+)"
| eval from=if(interaction=0, "", from)
| eval from=if("$landing_page$"!="*", "$site$"."$landing_page$", from)
| table http_session from to interaction
| where interaction>=1
| where to!="$landing_page$"
| where to!=from
| stats count by from,to,interaction
| sort interaction,-count,from,to
| streamstats global=f count AS interaction_rank by interaction
| where interaction_rank<=round($limit$/10,0)
| stats sum(count) AS count by from,to
| sort from to count
| head $limit$

I've tried this and inserted it after | rex field=Web.uri mode=sed "$rexlandingpage$" :

| eval Web.uri=Web.uri+" ("+count+")"

But this don't work.

Whats wrong?

Thanks a lot
Johannes

0 Karma
Highlighted

Re: Add count to user journey flow in Splunk App for Web Analytics

Super Champion

just as a quick glance, have you tried:

| eval "Web.uri"='Web.uri'+" ("+count+")"
0 Karma
Highlighted

Re: Add count to user journey flow in Splunk App for Web Analytics

Path Finder

Not working sry 😞

0 Karma
Highlighted

Re: Add count to user journey flow in Splunk App for Web Analytics

Path Finder

The result is always 1 but that cant be the right?

0 Karma
Highlighted

Re: Add count to user journey flow in Splunk App for Web Analytics

Super Champion

have you broken the syntax down to simply just count the web uri to see what it should be? make sure it's all coming in right.

0 Karma
Highlighted

Re: Add count to user journey flow in Splunk App for Web Analytics

Path Finder

I've tried this but can't find a way to deal with this 😕

0 Karma
Highlighted

Re: Add count to user journey flow in Splunk App for Web Analytics

Path Finder

@woodcock Do you have any idea what I can do?

0 Karma
Highlighted

Re: Add count to user journey flow in Splunk App for Web Analytics

Esteemed Legend

You can fix this:

| eval Web.uri=Web.uri+" ("+count+")"

With this:

| eval Web.uri=$Web.uri$+" ("+count+")"

Or this:

| eval Web.uri='Web.uri'+" ("+count+")"
0 Karma