Splunk Search

How to use timechart with a calculated field?

ra01
Path Finder

I have this search that displays my conversion rate:

tag=external_traffic  eventtype=pageactions session_id=\*
| transaction session_id startswith=(referrer=/store/category/page)  maxpause=30m mvlist=f
| eval didco = if(match(url, "/checkout/order"), 1, 0 )
| stats sum(didco) as cr , count as sessions by experienceId
| eval conv_rate = cr/sessions
 | table experienceId conv_rate

This gives me the conversion rate for the search period, but how can I do this as a daily number?

Notice the "experienceId" there are 2 experiences on the site, and I want to see the conversion rate for both them on a daily chart.

0 Karma

sundareshr
Legend

Try this

.... | bin span=1d _time | chart sum(didco) as cr , count as sessions over _time by experienceId | ...
0 Karma

ra01
Path Finder

that seems like most of the way there if I replace " | stats sum(didco) as cr , count as sessions by experienceId" with what you wrote.

The problem is the chart or summary table doesn't show the "conv_rate" field I was trying to calculate.

0 Karma

sundareshr
Legend

You will need to add the eval conv_rate=cr/sessions. Do you not get the conv_rate if you add it after the chart command.I used the chart command to give you daily totals.

0 Karma

ra01
Path Finder

the conv_rate value doesn't show up on the summary table or the chart.

I have it as:
| bin span=1h _time
| chart sum(didco) as cr , count as sessions over _time by experienceId
| eval conv_rate = cr/sessions

I am getting summary info for CR and Sessions, just not the conv_rate

0 Karma

sundareshr
Legend

What if you add the | table experienceId conv_rate Does it show then?

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...