How to identify session from log based on request timestamp

moohkhol — Mon, 28 Sep 2020 15:32:05 GMT

Hi Guys,
My log message looks like below,

Time message
10:00 AM “log message 1”
10:10 AM “log message 2”
10:20 AM “log message 2”
10:41 AM “log message 3”
10:45 AM “log message 4”

11:20 AM “log message 5”
11:21 AM “log message 6”
11:22 AM “log message 7”
11:25 AM “log message 8”
11:45 AM “log message 9”
11:55 AM “ ….”
12:28 PM “…..”

I want above message to be grouped into 4 groups and print following,

Start_time 10:00 AM count 5
Start_time 11:20 AM count 6
Start_time 12:28 PM count 1

We are splitting message based on the any two consecutive record having time difference of more than 30 min.
Here, 10:45 AM and 11:20 AM is having 35 min, so breaking it and again we found at 11:55 AM, since difference between 11:55 AM and 12:28 PM is 33 Min.

Re: How to identify session from log based on request timestamp

martin_mueller — Mon, 23 Dec 2013 17:08:44 GMT

That sounds like a job for transaction with maxpause=30m. See http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction for in-depth info.

topic How to identify session from log based on request timestamp in Splunk Search

How to identify session from log based on request timestamp

Re: How to identify session from log based on request timestamp