https://community.splunk.com/t5/Splunk-Dev/Translating-a-defined-tracking-session-using-SPL/m-p/375984#M6188 <P>How would I do this in SPL?</P> <P>I want to calculate a tracking session: <BR /> Find an ENTER event in the log. <BR /> Search forward in the log data for events after this event with the same device ID and same account ID. Sort them by date (ascending).<BR /><BR /> Walk through the log events in order, adding them to the session. If any of the following occurs, we stop searching:<BR /><BR /> If the next is more than "session timeout" (default 5 minutes) after the previous event in the session, consider the session terminated.<BR /><BR /> If an EXIT or TIMEOUT event occurs, consider the session terminated.<BR /><BR /> Find the last non-timeout event. <BR /> Session duration calculation is based on the time difference between the first event and the last non-timeout event. </P> Mon, 07 May 2018 18:38:59 GMT dwong2 2018-05-07T18:38:59Z https://community.splunk.com/t5/Splunk-Dev/Translating-a-defined-tracking-session-using-SPL/m-p/375984#M6188 <P>How would I do this in SPL?</P> <P>I want to calculate a tracking session: <BR /> Find an ENTER event in the log. <BR /> Search forward in the log data for events after this event with the same device ID and same account ID. Sort them by date (ascending).<BR /><BR /> Walk through the log events in order, adding them to the session. If any of the following occurs, we stop searching:<BR /><BR /> If the next is more than "session timeout" (default 5 minutes) after the previous event in the session, consider the session terminated.<BR /><BR /> If an EXIT or TIMEOUT event occurs, consider the session terminated.<BR /><BR /> Find the last non-timeout event. <BR /> Session duration calculation is based on the time difference between the first event and the last non-timeout event. </P> Mon, 07 May 2018 18:38:59 GMT https://community.splunk.com/t5/Splunk-Dev/Translating-a-defined-tracking-session-using-SPL/m-p/375984#M6188 dwong2 2018-05-07T18:38:59Z