Splunk Search

How to use timechart with a calculated field?

ra01
Path Finder

I have this search that displays my conversion rate:

tag=external_traffic  eventtype=pageactions session_id=\*
| transaction session_id startswith=(referrer=/store/category/page)  maxpause=30m mvlist=f
| eval didco = if(match(url, "/checkout/order"), 1, 0 )
| stats sum(didco) as cr , count as sessions by experienceId
| eval conv_rate = cr/sessions
 | table experienceId conv_rate

This gives me the conversion rate for the search period, but how can I do this as a daily number?

Notice the "experienceId" there are 2 experiences on the site, and I want to see the conversion rate for both them on a daily chart.

0 Karma

sundareshr
Legend

Try this

.... | bin span=1d _time | chart sum(didco) as cr , count as sessions over _time by experienceId | ...
0 Karma

ra01
Path Finder

that seems like most of the way there if I replace " | stats sum(didco) as cr , count as sessions by experienceId" with what you wrote.

The problem is the chart or summary table doesn't show the "conv_rate" field I was trying to calculate.

0 Karma

sundareshr
Legend

You will need to add the eval conv_rate=cr/sessions. Do you not get the conv_rate if you add it after the chart command.I used the chart command to give you daily totals.

0 Karma

ra01
Path Finder

the conv_rate value doesn't show up on the summary table or the chart.

I have it as:
| bin span=1h _time
| chart sum(didco) as cr , count as sessions over _time by experienceId
| eval conv_rate = cr/sessions

I am getting summary info for CR and Sessions, just not the conv_rate

0 Karma

sundareshr
Legend

What if you add the | table experienceId conv_rate Does it show then?

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...