topic Re: How to return first 2 events in a httpSession? in Splunk Search

How to return first 2 events in a httpSession?

cheriemilk — Tue, 27 Oct 2020 07:22:38 GMT

Hi team,

I have below sample raw data in splunk:

2020-10-27 06:43:56.351 action=view_page httpSessionID = 11
2020-10-27 06:43:57.351 action=click_create_button httpSessionID = 11
2020-10-27 06:43:58.351 action=save httpSessionID = 11
2020-10-28 03:33:33.351 action=view_page httpSessionID = 22
2020-10-28 03:33:34.351 action=filter httpSessionID = 22
2020-10-28 03:33:35.351 action=update httpSessionID = 22
2020-10-29 01:11:11.351 action=view_page httpSessionID = 33

the number of event in a httpSessionID is dynamic. For example: it could be 1, 2, 3, 4....10...20 etc..

Now I want splunk to return me the first two events in a httpSessionID, how the query should be?

Thanks,

Cherie

Re: How to return first 2 events in a httpSession?

ITWhisperer — Tue, 27 Oct 2020 08:02:02 GMT

| streamstats count as row by sessionId | where row < 3

Re: How to return first 2 events in a httpSession?

cheriemilk — Tue, 27 Oct 2020 08:56:51 GMT

Hi @ITWhisperer I want it return first 2 events in every httpSession, instead of filtering out the sessions where there're less than 3 events.

Thanks,

Cherie

Re: How to return first 2 events in a httpSession?

ITWhisperer — Tue, 27 Oct 2020 09:10:07 GMT

Hi @cheriemilk

Did you try what I suggested?

The streamstats will effectively add a count to each event within a session i.e the first event for session A will have a row of 1, the second will have a row of 2, and the first event for session B will have a row of 1 etc. Therefore, the only events with row less than 3 are the first two event for each session. You may need to do a reverse beforehand otherwise you may end up with the last two in each session

| reverse | streamstats count as row by sessionId | where row < 3

Re: How to return first 2 events in a httpSession?

cheriemilk — Wed, 28 Oct 2020 05:44:29 GMT

@ITWhisperer

You're right. I ever thought streamstats count as row by sessionID is to count the number of events in a session.

Thanks,

Cherie