Drop off count in website.

[sandeepmakkena]

I am working on website sales data where n number of different services are called like CartService, OrderBuildService, CheckoutOfferService,ShippingService and WEB_ORDER_RELEASE. I would like to know drop off rate between any two services.
Say order makes from CartService to Web_Order_release is successfully processed order.
Thanks for your time.

[richgalloway]

This is a two-step process First count the number of events of each service, in process order. Then use streamstats to find the difference in the count between a service and it predecessor.

... | eval sorter = case(service="CartService", 1, service="OrderBuildService", service="CheckoutOfferService", service="ShippingService", service="Web_Order_release", 1==1, "unknown") 
| stats count values(service) as service by sorter
| streamstats window=2 range(count) as dropoff
| table service count dropoff

[sandeepmakkena]

When I do that, all the stats are going to unknown sorter.

[richgalloway]

Verify the service names are correct and the field name 'service' is legit.
If that all checks out, try this alternative:

... | eval sorter = case(like(service,"CartService"), 1, like(service,"OrderBuildService"), like(service,"CheckoutOfferService"), like(service,"ShippingService"), like(service,"Web_Order_release"), 1==1, "unknown")
| stats count values(service) as service by sorter
| streamstats window=2 range(count) as dropoff
| table service count dropoff