topic Is it possible to aggregate and search within aggregated results? in Splunk Search

Is it possible to aggregate and search within aggregated results?

sohymg — Tue, 29 Sep 2020 13:47:45 GMT

My app logs multiple lines per request and each line has a "request_id" key for identification. For each request, there is an optional log line that contains a "session_id" key. How do I search to show all the log lines of a particular request which includes the "session_id" key?

Example:
request_id=1, msg=A
request_id=1, msg=B
request_id=2, msg=C, session_id=1
request_id=2, msg=D

Wanted result:
request_id=2, msg=C, session_id=1
request_id=2, msg=D

Re: Is it possible to aggregate and search within aggregated results?

adonio — Mon, 24 Apr 2017 14:45:00 GMT

Hello sohymg,
indicate in your search that you are looking for events with the session field

index = <yourIndex> sourcetype = <yourSourcetype> request_id=* msg=* session=* | table _time host request_id msg session

hope it helps

Re: Is it possible to aggregate and search within aggregated results?

DalJeanis — Mon, 24 Apr 2017 17:01:20 GMT

Your text says session_id but your example says session=. adonio's answer assumed the example data was correct, as opposed to your written description.

Re: Is it possible to aggregate and search within aggregated results?

sohymg — Tue, 29 Sep 2020 13:48:07 GMT

I tried this and there was no result. Just to clarify:

This is the entire dataset:
request_id=1, msg=A
request_id=1, msg=B
request_id=2, msg=C, session=1
request_id=2, msg=D

This is the result I need:
request_id=2, msg=C, session=1
request_id=2, msg=D

Re: Is it possible to aggregate and search within aggregated results?

adonio — Tue, 25 Apr 2017 12:51:52 GMT

did you replace the values for index and sourcetype to match yours?

Re: Is it possible to aggregate and search within aggregated results?

sohymg — Tue, 29 Sep 2020 13:48:31 GMT

Sorry there was some typo. I got it to work but the result is not what i want

Returned result:
request_id=2, msg=C, session=1

This is the result I need:
request_id=2, msg=C, session=1
request_id=2, msg=D

Re: Is it possible to aggregate and search within aggregated results?

adonio — Wed, 26 Apr 2017 12:02:44 GMT

so to be clear, what you would like to see is: if you have a value of 1 under the session field (session=1) then you want to see all events with request_id=2. is that correct?

Re: Is it possible to aggregate and search within aggregated results?

jkat54 — Wed, 26 Apr 2017 14:51:11 GMT

| eval r=_raw
| fields - _time _raw
| makemv r delim="request_" 
| mvexpand r 
| rex field=r "id=(?<request_id>\d+)\,\s+msg=(?<msg>\w+)(\,\s+session_id=(?<session>\d+))?" 
| rex field=r mode=sed "s/^id=/request_id=/g"
| search request_id=2 
| fields r

Re: Is it possible to aggregate and search within aggregated results?

sohymg — Thu, 27 Apr 2017 01:08:39 GMT

Yes thats correct

Re: Is it possible to aggregate and search within aggregated results?

sohymg — Thu, 27 Apr 2017 01:18:32 GMT

I get some rows but they are empty.