Hi, I'm trying to build a cohort report in splunk and I can't think of an easy way other than a million joins.
Let's say I want to measure retention to my site. I would take all the users who visited my site on the week of June 5th and see how much of them return in the following weeks. The same thing I would do for each of the following weeks.
June 5 | 100 | 20 | 15 | 10 | 10 June 12 | 110 | 40 | 35 | 30 | June 19 | 106 | 50 | 44 | | June 26 | 100 | 55 | | |
I've built a cohort like this with more than 10 different joins and a few appends.
Is there a simpler way? streamstats perhaps?
Hi turns out it was easier than I thought :) Here's what I did
scheduled job - test##:
"| loadjob savedsearch="yarin:search:test#" | dedup userId week | join userId type=inner max=0 [| loadjob savedsearch="yarin:search:test##" | rename week as weeks | streamstats count as rank by userId] | chart dc(userId) as users by week,rank | streamstats count as rank | rename "1" as week1 | rename "2" as week2 | rename "3" as week3 | rename "4" as week4 "
answered 22 Aug '12, 05:59