Can you help me build a query that shows time stamp for each user > session?

[bluemarvel]

This query gives me the time stamp once for each user, but not each time the user gets a session.

index="*" sourcetype=* 
|search "field:" 
|rex field=_raw "User:  (?<user>\S+)\)" 
|rex field=_raw "Session: (?<session>.*?)\."
|bin _time span=10m 
|dedup user session ID 
|stats values(ID) count by _time user session 
| where count >= 50

[DalJeanis · Accepted solution]

Your dedup is part of the problem, but I suspect there is another.

If you are trying to detect the number of simultaneous sessions, then try something like this...

 index="*" sourcetype=* 
 |search "field:" 
 |rex field=_raw "User:  (?<user>\S+)\)" 
 |rex field=_raw "Session: (?<session>.*?)\."
 |bin _time as Time span=10m 
 |stats values(ID) dc(session) as dcSession values(session_) as valSession list(session) as listSession list(_time) as listTime by Time user
 | where dcSessions >= 50

[rbreton]

Could you paste a couple sample log entries?

[adonio]

your dedup removes all values with user and sessionID but 1