How it works...

In this recipe, our search returned a count by item of how many items were viewed versus how many were added to the cart. In this case, the item field represents a unique item ID for a specific product.

Let's break down the search piece by piece:

Search fragment

Description

index=main sourcetype=access_combined

You should now be familiar with this search from earlier recipes in this chapter.

uri_path="/viewItem" OR uri_path="/addItem" status=200

Following the best practice of making our search as granular as possible, we are only searching for events that contain uri_paths related to viewing items and adding items that have a successful status code of 200. This type of granularity will greatly limit the amount ...

Get Splunk Operational Intelligence Cookbook - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.