Hi!
I'm using this search to calculate the exit rate of each page visited on a web site, count how many time a page was view and count how many time a page is the exit page:
...| where isnotnull(pagename) | eventstats count as visits by pagename | eval cookie=visid_high.visid_low.visit_num | transaction mvlist=t cookie | eval lastpage=mvindex(pagename,-1) | eventstats count as exits by lastpage | table pagename visits lastpage exits | where match(lastpage, pagename) |dedup pagename | eval exit_rate=exits/visits*100
Why this search finds results if I choose a period of 2 days or so, but for 3 months it answers No results found?
The job inspector puts in yellow
| table pagename visits lastpage exits | where match(lastpage, pagename) |dedup pagename | eval exit_rate=exits/visits*100
Thanks
Erica
You can give the Search Exploder in SideviewUtils 3+ a shot for debugging at each pipe.
Hi emaccaferri,
without any detailed information this is hard to answer, but try to set a maxspan
option for transaction
. If not set, transaction
is using by default no limit
- meaning if you search 3 month, transaction
is search all events in the 3 month and will build a transaction set based on cookie
.
hope this helps ...
cheers, MuS
wich kind of detailed information do you need?
I knew how transaction works, but what's splunk problem to eventually makes a 3 months transaction?
The query is not wrong in syntax, for a single day o few more I get what I need.