topic Re: Compare fields in a table in Splunk Search

Compare fields in a table

ejread — Wed, 03 Oct 2012 20:31:10 GMT

I have a table generated from two fields, sessionid and host -

... | stats count by sessionid host

I am trying to find only the sessionids that appear on more than one host. So basically, I need to compare each sessionid/host pair that appears in the logs with subsequent pairs for the same sessionid, but a different host.

Re: Compare fields in a table

gkanapathy — Wed, 03 Oct 2012 20:56:01 GMT

 ... | stats count by sessionid host | eventcount dc(host) as hc by sessionid | where hc >= 2

or you could do:

... | values(host) as hosts by sessionid | where mvcount(hosts) >= 2

but that gives you a less flexible set of results.

Re: Compare fields in a table

ldurrani — Thu, 04 Oct 2012 20:06:16 GMT

This will give you what you are looking for.

... | transaction pdsessionid maxspan=30s maxpause=5s | eval hcount = mvcount(host) | where hcount > 1