Knowledge Management

summary index and transactions spanning more than one summary interval

jskopis5668
Explorer

I would like to build a summary index (runs hourly) of the following:

sourcetype=http_access | transaction SESSION_ID maxspan=1800s maxpause=120s | sistats count

The summary index works fine but I am worried the same session is counted twice if the session more than one summary interval.

Lets say user X starts a session at 13:59. The user makes a requests at 13:59, 14:00, 14:01

The session is counted once for the 13th hour but then it's counted again for the 14th hour.

Is there a way to exclude sessions that were started in the previous interval?

I think what I want is to run the summary query every 30min looking at the previous hour. However I want to exclude transactions where the transaction start time is greater than 30min ago.

1 Solution

jskopis5668
Explorer

There was an old forum post about this one. Thanks duckfez:

http://www.splunk.com/support/forum:SplunkReporting/3870

I should add that I ended up doing this:

earliest=-90m | transaction SESSION_ID maxspan=1800s maxpause=120s | where _time < relative_time(time(), "-30m") and _time > relative_time(time(),"-60m")

View solution in original post

0 Karma

jskopis5668
Explorer

There was an old forum post about this one. Thanks duckfez:

http://www.splunk.com/support/forum:SplunkReporting/3870

I should add that I ended up doing this:

earliest=-90m | transaction SESSION_ID maxspan=1800s maxpause=120s | where _time < relative_time(time(), "-30m") and _time > relative_time(time(),"-60m")

0 Karma

jskopis5668
Explorer

There was an old forum post about this one. Thanks duckfez:

http://www.splunk.com/support/forum:SplunkReporting/3870

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...