Splunk Search

How to get top products used by customers?

sunilkumar
New Member

I'm trying to get the top products used by customers.

Labels (3)
0 Karma

sunilkumar
New Member

I tried this index=f5_access sourcetype=f5_access_lo 
I got events with base URI, source type, URL, etc.

 

 

0 Karma

PickleRick
Ultra Champion

Ok. So judging from the naming this looks like logs from F5 solution. In order to answer your question you'll have to know what "products" mean in this context (and where they are included in your logs) and how do you define "top" products - used by most customers? How do you distinguish customers then? By unique IP? By some session identifier?

0 Karma

sunilkumar
New Member

Hi Rick,
Thanks for the quick response.
Here the product is a table name, which is in the URL and customers have a unique name called instance it is also in the URL.  sc_catalog is the product here

Screen Shot 2023-03-07 at 12.21.33 PM.png

0 Karma

yuanliu
SplunkTrust
SplunkTrust

So, "product" is just the last segment of PATH_INFO.  Here is a general method to process URI field semantically.

 

| eval uri = split(urldecode(uri), "?")
| eval PATH_INFO = mvindex(uri, 0)
| eval product = mvindex(split(PATH_INFO, "/"), -1) ``` last segment ```
| eval QUERY_STRING = mvindex(uri, 1)
| rename _raw AS temp, QUERY_STRING AS _raw
| kv kvdelim="=" pairdelim="&"
| rename temp AS _raw

 

 Here, you not only get "product", but also parameters in QUERY_STRING.

To find top "product", then, is just an exercise of counting.

 

| eval uri = split(urldecode(uri), "?")
| eval PATH_INFO = mvindex(uri, 0)
| eval product = replace(mvindex(split(PATH_INFO, "/"), -1), "\.do$", "")
| top 5 product ``` replace 5 with however many you want ```

Here, we drop ".do" from "product" name.  This is just cosmetic.

Two additional points: When you ask a question, always illustrate your data (anonymize as needed), but in text.  This is a Splunk search forum, not an F5 forum.  Explain how the data should logically lead to your desired results.

Another pointer is about anonymization.  Public IP address can reveal a great deal about the business. (Even private IP address should be altered as a general rule.)

 

Tags (3)

PickleRick
Ultra Champion

What do your events look like? What have you tried so far? With what outcome?

0 Karma
Get Updates on the Splunk Community!

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...