Splunk Search

How to use timechart with a calculated field?

ra01
Path Finder

I have this search that displays my conversion rate:

tag=external_traffic  eventtype=pageactions session_id=\*
| transaction session_id startswith=(referrer=/store/category/page)  maxpause=30m mvlist=f
| eval didco = if(match(url, "/checkout/order"), 1, 0 )
| stats sum(didco) as cr , count as sessions by experienceId
| eval conv_rate = cr/sessions
 | table experienceId conv_rate

This gives me the conversion rate for the search period, but how can I do this as a daily number?

Notice the "experienceId" there are 2 experiences on the site, and I want to see the conversion rate for both them on a daily chart.

0 Karma

sundareshr
Legend

Try this

.... | bin span=1d _time | chart sum(didco) as cr , count as sessions over _time by experienceId | ...
0 Karma

ra01
Path Finder

that seems like most of the way there if I replace " | stats sum(didco) as cr , count as sessions by experienceId" with what you wrote.

The problem is the chart or summary table doesn't show the "conv_rate" field I was trying to calculate.

0 Karma

sundareshr
Legend

You will need to add the eval conv_rate=cr/sessions. Do you not get the conv_rate if you add it after the chart command.I used the chart command to give you daily totals.

0 Karma

ra01
Path Finder

the conv_rate value doesn't show up on the summary table or the chart.

I have it as:
| bin span=1h _time
| chart sum(didco) as cr , count as sessions over _time by experienceId
| eval conv_rate = cr/sessions

I am getting summary info for CR and Sessions, just not the conv_rate

0 Karma

sundareshr
Legend

What if you add the | table experienceId conv_rate Does it show then?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...