Getting Data In

data filtering(?) question

hylee
Explorer

Hi,
In our website, all the visitors get SESSION_ID.

for example,
[no=1 visit_time=2013/07/02 09:30:30 session_id=aaa]
[no=2 visit_time=2013/07/02 09:35:30 session_id=aaa]
[no=3 visit_time=2013/07/02 09:40:30 session_id=bbb]
[no=4 visit_time=2013/07/02 09:50:30 session_id=ccc]

When index to SPLUNK, search result(count) is "4".

"no=1..." and "no=2..." are same people.
In this case, this people visited two times our website in 10 minutes.

Q)
If someone visit several times(ex. 3 times) in 10 minutes, is there a way to see the result(count) as "1"?

Tags (3)
0 Karma
1 Solution

adityapavan18
Contributor

I guess you could use transaction command on session_id with max span and do a count like

|transaction session_id maxspan=10m | stats count

this might work!!

View solution in original post

0 Karma

adityapavan18
Contributor

I guess you could use transaction command on session_id with max span and do a count like

|transaction session_id maxspan=10m | stats count

this might work!!

0 Karma

hylee
Explorer

Thank you so much!! I solved it!!

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...