Report to get conversion path from apache logs

[opticsplanet]

I need to build conversion paths for customers based on apache logs, and not sure if I can accomplish this with Splunk.

When customer buys something (visits confirmation page uri), I need to collect all previously visited pages, up until another order was placed (confirmation page), or more than 3 weeks of inactivity (identifying customer by IP address).

Is this even possible with Splunk? How can I build 2-tier reports like that? Would appreciate if anyone can point me in the right direction to read up on this matter.

[opticsplanet · Accepted solution]

Some digging around landed me at the use of appended search to accomplish this. Some post processing required to satisfy additional requirements (like "since last confirmation page" and others) but still close enough:

eventtype="web-traffic-external" (uri_path=/*.html OR uri_path=/checkout/*) [search eventtype="web-traffic-external" uri_path=/checkout/confirmation earliest=-1h | dedup clientip | fields clientip] | sort clientip, _time | fields clientip, uri_path