Splunk Search

Report to get conversion path from apache logs

opticsplanet
Path Finder

I need to build conversion paths for customers based on apache logs, and not sure if I can accomplish this with Splunk.

When customer buys something (visits confirmation page uri), I need to collect all previously visited pages, up until another order was placed (confirmation page), or more than 3 weeks of inactivity (identifying customer by IP address).

Is this even possible with Splunk? How can I build 2-tier reports like that? Would appreciate if anyone can point me in the right direction to read up on this matter.

1 Solution

opticsplanet
Path Finder

Some digging around landed me at the use of appended search to accomplish this. Some post processing required to satisfy additional requirements (like "since last confirmation page" and others) but still close enough:

eventtype="web-traffic-external" (uri_path=/*.html OR uri_path=/checkout/*) [search eventtype="web-traffic-external" uri_path=/checkout/confirmation earliest=-1h | dedup clientip | fields clientip] | sort clientip, _time | fields clientip, uri_path

View solution in original post

opticsplanet
Path Finder

Some digging around landed me at the use of appended search to accomplish this. Some post processing required to satisfy additional requirements (like "since last confirmation page" and others) but still close enough:

eventtype="web-traffic-external" (uri_path=/*.html OR uri_path=/checkout/*) [search eventtype="web-traffic-external" uri_path=/checkout/confirmation earliest=-1h | dedup clientip | fields clientip] | sort clientip, _time | fields clientip, uri_path
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...