Splunk Search

How to use timechart with a calculated field?

Path Finder

I have this search that displays my conversion rate:

tag=external_traffic  eventtype=pageactions session_id=\*
| transaction session_id startswith=(referrer=/store/category/page)  maxpause=30m mvlist=f
| eval didco = if(match(url, "/checkout/order"), 1, 0 )
| stats sum(didco) as cr , count as sessions by experienceId
| eval conv_rate = cr/sessions
 | table experienceId conv_rate

This gives me the conversion rate for the search period, but how can I do this as a daily number?

Notice the "experienceId" there are 2 experiences on the site, and I want to see the conversion rate for both them on a daily chart.

0 Karma

Legend

Try this

.... | bin span=1d _time | chart sum(didco) as cr , count as sessions over _time by experienceId | ...
0 Karma

Path Finder

that seems like most of the way there if I replace " | stats sum(didco) as cr , count as sessions by experienceId" with what you wrote.

The problem is the chart or summary table doesn't show the "conv_rate" field I was trying to calculate.

0 Karma

Legend

You will need to add the eval conv_rate=cr/sessions. Do you not get the conv_rate if you add it after the chart command.I used the chart command to give you daily totals.

0 Karma

Path Finder

the conv_rate value doesn't show up on the summary table or the chart.

I have it as:
| bin span=1h time
| chart sum(didco) as cr , count as sessions over _time by experienceId
| eval conv
rate = cr/sessions

I am getting summary info for CR and Sessions, just not the conv_rate

0 Karma

Legend

What if you add the | table experienceId conv_rate Does it show then?

0 Karma