Articles in this section

Building Metrics with Splunk Cloud

Avatar
Tony Gentile
  • Updated
Follow

Using our fully-functional free trial Datazoom account and the Splunk Cloud 15 day free trial, you can build a number of metrics to help you understand your users' experience. The examples below provide some simple steps you can follow to get started. Please review and complete our Splunk Cloud Connector setup steps before you begin. This will ensure that you can take advantage of the Datazoom free trial while utilizing the Splunk Cloud 15 day free trial to understand your data.

Creating the Metrics

You should have already created a Collector for your video player and have its configuration deployed. 

You should have already created a Connector for Splunk Cloud and have it as part of your Data Pipe with at least the following data points selected:
Bitrate
Buffer_End
First_Frame
Latitude
Longitude
Play_Request
sessionViewId
timeSinceBufferBegin
timeSinceRequested
totalPlayTime

Create a metric for the number of minutes watched

  1. Login to your Splunk Cloud instance and navigate to Search.

  2. Copy and paste the following into Search:

    index="<your index here>"
| search "event.metrics.totalPlayTime">0 
| dedup "user_details.sessionViewId" 
| rename event.metrics.totalPlayTime AS PlayTime 
| eval PlayTime=(PlayTime / 60000) 
| stats max(PlayTime) by user_details.sessionViewId 
| stats sum(max(PlayTime))
  3. Select the time period you'd like to search against in the right side of the "Search" tab found in the upper-left of the Splunk UI, then click the hourglass icon.
  4. Select the Visualization tab from the results window and then format as necessary. We changed the result's precision to two decimal places and added the unit "Minutes" after the result.

  5. Select "Save As" under the "Search and Reporting" text in the upper right to save the search as a Dashboard Panel.
  6. Select "New" then enter a name for your new dashboard next to "Dashboard Title" then click "Save"


Create a metric for the number of play requests

  1. Copy and paste the following into Search:

    index="<your index here>"
| spath "event.type"
| search "event.type"=Play_Request
| stats count
  2. Select the time period you'd like to search against in the right side of Search then click the hourglass icon.
  3. Select the Visualization tab from the results window then format as necessary. We added the unit "Play Requests" after the result.

  4. Select "Save As" under the "Search and Reporting" text in the upper right to save the search as a Dashboard Panel.
  5. Select "Existing" then select the name of the dashboard you created previously.


Create a metric for the number of play starts

  1. Copy and paste the following into Search:

    index="<your index here>"
| spath "event.type"
| search "event.type"=First_Frame 
| stats count
  2. Select the time period you'd like to search against in the right side of Search then click the hourglass icon.
  3. Select the Visualization tab from the results window then format as necessary. We added the unit "Play Starts" after the result.

  4. Select "Save As" under the "Search and Reporting" text in the upper right to save the search as a Dashboard Panel.
  5. Select "Existing" then select the name of the dashboard you created previously.

Create a metric to show where your viewers are located

  1. Copy and paste the following into Search:

    index="<your index here>"
| spath "user_details.session_id" 
| search "user_details.session_id">"0" 
| dedup user_details.session_id  
| geostats count latfield=geo_location.latitude longfield=geo_location.longitude
  2. Select the time period you'd like to search against in the right side of Search then click the hourglass icon.
  3. Select the Visualization tab from the results window then format as necessary. 

  4. Select "Save As" under the "Search and Reporting" text in the upper right to save the search as a Dashboard Panel.
  5. Select "Existing" then select the name of the dashboard you created previously.

Editing the dashboard

  1. Once you've created and saved your searches, you can click on the Dashboard tab and navigate to the dashboard you created earlier. From here you can edit the dashboard further and adjust as necessary.

Import a pre-built dashboard

Follow the steps below to take advantage of our Splunk dashboard example. 

Importing the dashboard

  1. Click on "Dashboards" then "Create New Dashboard"
  2. Enter a Title for the dashboard then click "Create Dashboard"

  3. Click the "Source" button. Select all and delete the contents of the Source editor window.

  4. Copy the code below and paste it into a text editor. Change the name of the index in the text below.  Search for index="main" and change it to the name of your index, index="<your index name>". Once complete, paste the entire edited text into the Source editor then click "Save".

    <form>
  <label>Datazoom Example</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="SessionID">
      <label>SessionID</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>Requests</title>
        <search>
          <query>index="main" $SessionID$
| spath "event.type"
| search "event.type"=Play_Request
| stats count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>1m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unit">Play Requests</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Time to First Frame Average</title>
        <search>
          <query>index="main" sourcetype =_json $SessionID$
| spath "event.type" 
| search "event.type" = "First_Frame" 
| spath "event.metrics.timeSinceRequested" 
| search "event.metrics.timeSinceRequested" > 0 
| rename event.metrics.timeSinceRequested AS timeToFirstFrameAverage 
| eval timeToFirstFrameAverage=(timeToFirstFrameAverage/1000) 
| stats avg(timeToFirstFrameAverage)</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0.00</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unit">Seconds</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Starts</title>
        <search>
          <query>index="main" $SessionID$
| spath "event.type"
| search "event.type"=First_Frame 
| stats count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unit">Play Starts</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Minutes Viewed</title>
        <search>
          <query>index="main" $SessionID$
| search "event.metrics.totalPlayTime">0 
| dedup "user_details.sessionViewId" 
|  rename event.metrics.totalPlayTime AS PlayTime 
| eval PlayTime=(PlayTime / 60000) 
| stats max(PlayTime) by user_details.sessionViewId 
| stats sum(max(PlayTime))</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>1m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0.00</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unit">Minutes</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <single>
        <title>Exit Before Video Start</title>
        <search>
          <query>index="main" sourcetype =_json $SessionID$
| search "First_Frame" OR "Play_Request" 
| stats count(eval(searchmatch("First_Frame"))) as FF count(eval(searchmatch("Play_Request"))) as PR 
| eval ebvs=(PR-FF)/PR*100
| chart values(ebvs)</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0.00</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unit">%</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Buffer Ratio</title>
        <search>
          <query>index="main" sourcetype =_json $SessionID$
| spath "event.type" | search "event.type" = "Buffer_End"
| spath "event.metrics.timeSinceBufferBegin" 
| search "event.metrics.timeSinceBufferBegin" >0
| rename event.metrics.timeSinceBufferBegin AS bufferTime
| eval bufferTime=bufferTime/60000 
| append [ 
| search "event.metrics.totalPlayTime">0 $SessionID$
| dedup "user_details.sessionViewId" 
| rename event.metrics.totalPlayTime AS timeWatched 
| eval timeWatched=max(timeWatched/60000)]
| stats sum(timeWatched) as time_Watched sum(bufferTime) as buffer_Time
| eval percentage=((buffer_Time/time_Watched )*100)
| chart values(percentage)</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0.00</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unit">%</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Average Bandwidth</title>
        <search>
          <query>index=main  $SessionID$
| spath "event.metrics.bandwidth"
| search "event.metrics.bandwidth"=* 
| stats AVG(event.metrics.bandwidth) AS Bandwidth 
| eval Bandwidth=Bandwidth/1000/1000</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0.00</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unit">Mbps</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Average Bitrate</title>
        <search>
          <query>index="main" $SessionID$
| spath "event.metrics.bitrate"
| search "event.metrics.bitrate"=* 
| search "event.metrics.bitrate"!=0
| rename event.metrics.bitrate AS bitRate
| stats sum(bitRate) AS totalBits count(eval(bitRate)) as countbitRate
| eval avgBitrate=(totalBits/countbitRate)/1000
| chart count by avgBitrate</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0.00</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unit">bps</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <map>
        <title>Viewer Location</title>
        <search>
          <query>index="main"  $SessionID$
| spath "user_details.session_id" 
| search "user_details.session_id">"0" 
| dedup user_details.session_id  
| geostats count latfield=geo_location.latitude longfield=geo_location.longitude</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>1m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="drilldown">none</option>
        <option name="mapping.choroplethLayer.colorBins">5</option>
        <option name="mapping.choroplethLayer.colorMode">auto</option>
        <option name="mapping.choroplethLayer.maximumColor">0xDB5800</option>
        <option name="mapping.choroplethLayer.minimumColor">0x2F25BA</option>
        <option name="mapping.choroplethLayer.neutralPoint">0</option>
        <option name="mapping.choroplethLayer.shapeOpacity">0.75</option>
        <option name="mapping.choroplethLayer.showBorder">1</option>
        <option name="mapping.data.maxClusters">100</option>
        <option name="mapping.legend.placement">bottomright</option>
        <option name="mapping.map.center">(39.23,-93.3)</option>
        <option name="mapping.map.panning">1</option>
        <option name="mapping.map.scrollZoom">0</option>
        <option name="mapping.map.zoom">4</option>
        <option name="mapping.markerLayer.markerMaxSize">50</option>
        <option name="mapping.markerLayer.markerMinSize">30</option>
        <option name="mapping.markerLayer.markerOpacity">0.5</option>
        <option name="mapping.showTiles">1</option>
        <option name="mapping.tileLayer.maxZoom">7</option>
        <option name="mapping.tileLayer.minZoom">0</option>
        <option name="mapping.tileLayer.tileOpacity">1</option>
        <option name="mapping.type">marker</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </map>
    </panel>
  </row>
</form>

  5. You will end up with a this dashboard that you can continue to refine to suit your needs.

Related articles

Comments

0 comments

Article is closed for comments.