topic data filtering(?) question in Getting Data In

data filtering(?) question

hylee — Mon, 28 Sep 2020 14:14:31 GMT

Hi,
In our website, all the visitors get SESSION_ID.

for example,
[no=1 visit_time=2013/07/02 09:30:30 session_id=aaa]
[no=2 visit_time=2013/07/02 09:35:30 session_id=aaa]
[no=3 visit_time=2013/07/02 09:40:30 session_id=bbb]
[no=4 visit_time=2013/07/02 09:50:30 session_id=ccc]

When index to SPLUNK, search result(count) is "4".

"no=1..." and "no=2..." are same people.
In this case, this people visited two times our website in 10 minutes.

Q)
If someone visit several times(ex. 3 times) in 10 minutes, is there a way to see the result(count) as "1"?

Re: data filtering(?) question

adityapavan18 — Wed, 03 Jul 2013 07:06:51 GMT

I guess you could use transaction command on session_id with max span and do a count like

|transaction session_id maxspan=10m | stats count

this might work!!

Re: data filtering(?) question

hylee — Thu, 04 Jul 2013 02:00:16 GMT

Thank you so much!! I solved it!!