topic Re: Two searches combined including transaction in Splunk Search

Two searches combined including transaction

DanielFordWA — Mon, 28 Sep 2020 13:59:41 GMT

The below gives me the correct number of hits per external user

sourcetype="iis-2" | extract auto=true | search CORE_employee="F*" | stats count(cs_uri_stem) AS Hits by cs_username date | fields date cs_username Hits

The second search below gives me the roughly correct number of visits per user, I need to refine it slightly.

How would I combine the two into one search that would result in a table

date, cs_username, Hits, Visits

Re: Two searches combined including transaction

wpreston — Wed, 29 May 2013 15:37:16 GMT

I reread your question and updated my search to address request more accurately. One way would be the append command, with some eval and possibly stats usage as well. The key is making each search have the same columns. How about something like this:

sourcetype="iis-2" 
    | extract auto=true 
    | search CORE_employee="F*" 
    | eval Visits=0 
    | stats count(cs_uri_stem) AS "Hits", sum(Visits) as "Visits" by cs_username date 
    | fields date cs_username Hits Visits 
| append [search sourcetype="iis-2" 
    | extract auto=true 
    | search CORE_employee="F*" 
    | transaction cs_username maxspan=30m 
    | eval Hits=0 
    | stats count AS "Visits", sum(Hits) as "Hits" by cs_username date 
    | fields date cs_username Hits Visits ] 
| stats sum(Hits) as "Hits", sum(Visits) as "Visits" by date, cs_username

Does this do what you need?

Re: Two searches combined including transaction

DanielFordWA — Wed, 30 Oct 2013 16:57:41 GMT

Sorry for the late reply, this does seem to work for some months and not others, I'll investigate a bit and see what the issue is. Thanks for the response.