Archive

How to get statistics from the same session with multiple events?

gumarovv
New Member

There are multiple events with 1 same field - unique_session, how to combine and count events from that unique session and get statistical data?

0 Karma

grittonc
Contributor

Some sample events and your desired outcome would be helpful.

0 Karma

Vijeta
Influencer

You can do

index=<your index>| stats count by user unique_session
0 Karma

gumarovv
New Member

this search will return all events - I need just the once that has same unique_session

0 Karma

grittonc
Contributor

| transaction unique_session
will tell you how many events there are and how long the session lasted.

0 Karma

gumarovv
New Member

I am getting results but it seems like not exactly correct ones. I am trying to combine and count event1 and event2 with same unique_session. But getting counts where only event2 or event1 are present

0 Karma

gumarovv
New Member

example of a search
event1=1 OR event2=2
| transaction unique_session
| stats count by user

Result returns users with event1 and event2

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!