Splunk Search

What is the best way to handle sequential event funnels?

andynu
Engager

Given a sequence of general to specific events (like product browsing a pages, followed by particular product pages). What is the best way to bring information from the browse events into the results for the product event?

log example

 time=1 session=1 pageType=browse name=NewStuff resultsCount=3
 time=2 session=1 pageType=product product=a
 time=3 session=1 pageType=product product=b

In the example a user hit a browse page with three products, and clicked through on two of them. I would like to transform those events into a table like this:

desire result

| session | srcBrowseName | Product |
| 1       | NewStuff      | a       |
| 1       | NewStuff      | b       |

Notice that I have to repeat data from the browse event for each of the product page events. I have an inkling that this could be accomplished with a subsearch, perhaps a subsearch of a |transaction session startswith="pageType=browse".

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Maybe:

pageType=product | join session usetime=true earliest=true [ pageType=browse | fields - resultsCount ]

is something like what you need?

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Maybe:

pageType=product | join session usetime=true earliest=true [ pageType=browse | fields - resultsCount ]

is something like what you need?

andynu
Engager

Thanks!

pageType=product |join session usetime=t earlier=t [search pageType=browse | fields + resultCount]

Unfortunately |join seems to be very particular about which types of fields it will work on, some of my fields that in independent searches extracted matching field values did not work as the join parameter.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...