Dashboards & Visualizations

numbering rows by field name?

Yarsa
Path Finder

How do I set a new column which specifies the occurence order of events, grouped by another field.

For example - users Y,X and Z had 5 sessions each.
How can I number their sessions from 1 to 5, so I can choose to analyze only data from their second session.

Thanks:)

Tags (1)
0 Karma
1 Solution

Ayn
Legend

If you have one event per session, you can use streamstats to create a count per user:

... | streamstats count AS session_number by user

View solution in original post

0 Karma

Ayn
Legend

If you have one event per session, you can use streamstats to create a count per user:

... | streamstats count AS session_number by user
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...