Consider how you want to group events into Journeys
After you identify the process you want to track and the corresponding Flow Model components, consider how you want to group the events into Journeys. When you create a Flow Model, you select each Correlation ID, Step, and Attribute from a list of field names. The assignment of field names as Correlation IDs, steps, and attributes is subjective, and depends on how you want to group related events into Journeys.
For example, say you are interested in tracking the customer workflow for an online store. You want to analyze what products customers purchased, the payment type used, and discover if customers encountered long wait times, payment errors, or other roadblocks on the website. You have the following field names in your data: username, action, location, and order ID. You create a Flow Model and select username as a Correlation ID, action as a step, and location as an attribute. Therefore, you can view the individual customer Journeys by username, based on the actions the customer took, and you can filter the results by location.
Examples
Suppose you are interested in tracking an order system process. In this process, there are two Correlation IDs Order ID
and Order line item ID
. Order ID
corresponds to a unique order submitted by a customer. Order line item ID
corresponds to the individual items contained in the order. For example, say you ordered two games from the Buttercup Games online store. Each game is an order line item. Your order has one order ID
because you placed one order, and two order line item IDs
because you have two order line items.
The following table shows a collection of events from the order system event log. This event log captures the following flow: an order line item ships from a warehouse, the order line item is in transit, then the order is delivered. Each event contains an Order ID
and an Order line item ID
. When you create a Flow Model, you select one or more Correlation IDs. Depending on how you want to structure your Journeys you can use either or both Order ID
and Order line item ID
as Correlation IDs.
This table also includes information about which warehouse the order shipped from. You can consider the warehouse information an attribute. An attribute is an optional component of a Flow Model. You can use attributes to filter your results.
Order ID
The following examples illustrate how different combinations of Correlation IDs affect event grouping. Assume that the search in the Flow Model is the same for all examples.
In this example, the events are grouped by Order ID
, which has two field values. Therefore, there are two Journeys: one for each field value of Order ID
.
The following table shows the field name and values of the correlation ID and attribute used in this example.
Field name | Field values |
---|---|
Order ID | order1, order2 |
Warehouse | wh1, wh2 |
If you add Order line item ID
as an attribute, the Journeys retain the same structure. When you add an attribute to a Flow Model, you include extra information that you can use to filter your results. In this case, you can view complete orders, and then filter by order line item.
Order ID and Order line item ID
In this example, the events are grouped by both Order ID
and Order line item ID
. The Flow Model uses gluing events to identify related events and group all subsequent and preceding steps with the same Correlation IDs into a Journey. When order1
and oli1.1
appear in the same event, all steps with either order1
or oli1.1
are grouped into the same Journey. There are three unique combinations of Order ID
and Order line item ID
, therefore there are three Journeys.
The following table shows the field names and values of the correlation IDs and attribute used in this example.
Field name | Field values |
---|---|
Order ID | order1, order2 |
Order line item ID | oli1.1, oli1.2, oli2.1 |
Warehouse | wh1, wh2 |
Suppose you notice an increase in average Journey duration. To investigate, you can add warehouse as an attribute and view all Journeys that pass through each warehouse.
Order line item ID
In this example, you are interested in tracking individual order line items. There are three order line items and therefore three Journeys. The following table shows the field name and values of the correlation ID and attribute used in this example.
Field name | Field values |
---|---|
Order line item ID | oli1.1, oli1.2, oli2.1 |
Warehouse | wh1, wh2 |
Suppose you want to compare the transit duration of order line items. An order, such as order1
, is not complete until all order line items are delivered. If you add order ID
as an attribute, then you can view line items by order and compare the duration of the order line item Journeys.
Identify your Correlation IDs, Steps, and Attributes | Write a search for a Flow Model |
This documentation applies to the following versions of Splunk® Business Flow (Legacy): -Latest-
Feedback submitted, thanks!