topic Re: Extract and count IDs from a table in Splunk Search

Extract and count IDs from a table

wkk — Fri, 10 Nov 2023 10:57:18 GMT

Hi! 🙂

I have a fallowing table:

SESSION_ID	SUBMITTED_FROM	STAGE
1		submit
1	startPage	someStage1
2		submit
2	page1	someStage1
2	page2	someStage2

How could I count the number of SESSION_IDs that has SUBMITTED_FROM=startPage and STAGE=submit?

So looking at the above table the outcome of that logic should be 2 SESSION_IDs

Re: Extract and count IDs from a table

gcusello — Fri, 10 Nov 2023 11:13:08 GMT

Hi @wkk,

you could try something like this:

Ciao.

Giuseppe

Re: Extract and count IDs from a table

wkk — Fri, 10 Nov 2023 14:52:11 GMT

@gcusello thank you that solved my case

Re: Extract and count IDs from a table

wkk — Fri, 10 Nov 2023 15:05:28 GMT

I slightly changed the query, as I didn't want to use search. Query ends up with the same results.

index=your_index | stats values(SUBMITTED_FROM) AS SUBMITTED_FROM values(STAGE) AS STAGE BY SESSION_ID | where SUBMITTED_FROM=startPage STAGE=submit | stats count BY SESSION_ID

Re: Extract and count IDs from a table

gcusello — Fri, 10 Nov 2023 15:59:22 GMT

Hi @wkk ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉