Splunk Search

Report to get conversion path from apache logs

opticsplanet
Path Finder

I need to build conversion paths for customers based on apache logs, and not sure if I can accomplish this with Splunk.

When customer buys something (visits confirmation page uri), I need to collect all previously visited pages, up until another order was placed (confirmation page), or more than 3 weeks of inactivity (identifying customer by IP address).

Is this even possible with Splunk? How can I build 2-tier reports like that? Would appreciate if anyone can point me in the right direction to read up on this matter.

1 Solution

opticsplanet
Path Finder

Some digging around landed me at the use of appended search to accomplish this. Some post processing required to satisfy additional requirements (like "since last confirmation page" and others) but still close enough:

eventtype="web-traffic-external" (uri_path=/*.html OR uri_path=/checkout/*) [search eventtype="web-traffic-external" uri_path=/checkout/confirmation earliest=-1h | dedup clientip | fields clientip] | sort clientip, _time | fields clientip, uri_path

View solution in original post

opticsplanet
Path Finder

Some digging around landed me at the use of appended search to accomplish this. Some post processing required to satisfy additional requirements (like "since last confirmation page" and others) but still close enough:

eventtype="web-traffic-external" (uri_path=/*.html OR uri_path=/checkout/*) [search eventtype="web-traffic-external" uri_path=/checkout/confirmation earliest=-1h | dedup clientip | fields clientip] | sort clientip, _time | fields clientip, uri_path
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...