We've been using the Mint Management Console on mint.splunk.com for reporting for quite some time. We recently switched to the HEC data collection mechanism and are trying to create similar queries in Splunk to produce the same report. We've run into an issue where the number of sessions over a seven day period doesn't come close to what the mint management console is reporting.
I started off simple enough, just doing a distinct count of session_id:
| stats dc(session_id)
However that didn't come close to the MMC.
Next I tried counting by day and then adding those together
| bin _time span=1d
| stats dc(session_id) AS Sessions BY _time
| eventstats sum(Sessions)
That got me closer to the same number, but still off by more than 100,000.
Any ideas as to how the MMC comes up with their session count and how I might reproduce that in Splunk?
Thanks for your help.
