Splunk Search

How to get top products used by customers?

sunilkumar
New Member

I'm trying to get the top products used by customers.

Labels (3)
0 Karma

sunilkumar
New Member

I tried this index=f5_access sourcetype=f5_access_lo 
I got events with base URI, source type, URL, etc.

 

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Ok. So judging from the naming this looks like logs from F5 solution. In order to answer your question you'll have to know what "products" mean in this context (and where they are included in your logs) and how do you define "top" products - used by most customers? How do you distinguish customers then? By unique IP? By some session identifier?

0 Karma

sunilkumar
New Member

Hi Rick,
Thanks for the quick response.
Here the product is a table name, which is in the URL and customers have a unique name called instance it is also in the URL.  sc_catalog is the product here

Screen Shot 2023-03-07 at 12.21.33 PM.png

0 Karma

yuanliu
SplunkTrust
SplunkTrust

So, "product" is just the last segment of PATH_INFO.  Here is a general method to process URI field semantically.

 

| eval uri = split(urldecode(uri), "?")
| eval PATH_INFO = mvindex(uri, 0)
| eval product = mvindex(split(PATH_INFO, "/"), -1) ``` last segment ```
| eval QUERY_STRING = mvindex(uri, 1)
| rename _raw AS temp, QUERY_STRING AS _raw
| kv kvdelim="=" pairdelim="&"
| rename temp AS _raw

 

 Here, you not only get "product", but also parameters in QUERY_STRING.

To find top "product", then, is just an exercise of counting.

 

| eval uri = split(urldecode(uri), "?")
| eval PATH_INFO = mvindex(uri, 0)
| eval product = replace(mvindex(split(PATH_INFO, "/"), -1), "\.do$", "")
| top 5 product ``` replace 5 with however many you want ```

Here, we drop ".do" from "product" name.  This is just cosmetic.

Two additional points: When you ask a question, always illustrate your data (anonymize as needed), but in text.  This is a Splunk search forum, not an F5 forum.  Explain how the data should logically lead to your desired results.

Another pointer is about anonymization.  Public IP address can reveal a great deal about the business. (Even private IP address should be altered as a general rule.)

 

Tags (3)

PickleRick
SplunkTrust
SplunkTrust

What do your events look like? What have you tried so far? With what outcome?

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...