Splunk AppDynamics

Session Id count

CommunityUser
Splunk Employee
Splunk Employee

Hi,

Can anyone please explain what does "count" option signify for session ID in analytics. 

When i select "count distict" instead of count the value changes to 1, this is understandable since each user has a unique session ID.

PFB the screenshot.

Labels (1)
0 Karma
1 Solution

Chitra_Lal
Contributor

Hi Rahul,

This is because you are trying to create a metric based on a search that is trying to fetch two fields at a time;  You can give only a single field in the query for creating metrics, like: 

SELECT series(eventTimestamp, '6m') FROM web_session_records WHERE appkey = "AD-AAB-AAF-XCP" LIMIT 2000

OR

SELECT distinctcount(sessionguid) FROM web_session_records WHERE appkey = "AD-AAB-AAF-XCP" LIMIT 2000

Thanks,

Chitra

View solution in original post

Chitra_Lal
Contributor

Hi Rahul,

"Count" will ideally give you the total number of records that came in the selected time range whereas "distinctcount" will get you how many distinct types of those records were reported in that same time frame. So for session guids,so you can use it to plot number of Active Sessions overtime For example count distict user sessions recorded for any specific application(using its appkey):

SELECT distinctcount(sessionguid) FROM web_session_records WHERE appkey = "AD-AAB-AAB-PJZ" AND closed != true
SELECT series(eventTimestamp, '6m', 1503475998118, 1503479598118), distinctcount(sessionguid) FROM web_session_records WHERE appkey = "AD-AAB-AAE-MHF" LIMIT 2000

This will watch all open session per minute and create analytics metrics for the same so that over the period of time you will only see open active sessions count and the metric will roll over to 1min > 10min > 1 hr like other APM metric. 

Refer to the doc lin for better clarity: https://docs.appdynamics.com/display/PRO44/Create+Analytics+Metrics+From+Scheduled+Queries

Hope that helps. Let me know in case you have any further queries.

Thank You,

Chitra

CommunityUser
Splunk Employee
Splunk Employee

Hi Chitra,

Thank you very much for your valuable response. Both of the examples helped me to understand the concept of count and distinct count wrt session id's.

I do have another question, i hope user session metric is not availabe by default on the metric browser. If i had to plot the user session with respect to individual products present in an application, how can i plot the graph to show it on the dashboard.With the 2nd example:

SELECT series(eventTimestamp, '6m', 1503475998118, 1503479598118), distinctcount(sessionguid) FROM web_session_records WHERE appkey = "AD-AAB-AAE-MHF" LIMIT 2000

i have tried to create a custom metric, it gives me an error "only single field metrics are allowed". I have attached a screen shot, i am trying to achive the same dashboard. I will be able to fetch all the details except the user sessions. i have marked it in red box.

Can you please let me know how can i achieve fetching the user sessions.

Regards,

Rahul

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Hi @Anonymous

Were you able to resolve the issue using the tips suggested by @Chitra.Lal?

If so, please mark her response as the accepted solution to enable easy and efficient searchability.

Let us know if you have further questions or concerns.

Chitra_Lal
Contributor

Hi Rahul,

This is because you are trying to create a metric based on a search that is trying to fetch two fields at a time;  You can give only a single field in the query for creating metrics, like: 

SELECT series(eventTimestamp, '6m') FROM web_session_records WHERE appkey = "AD-AAB-AAF-XCP" LIMIT 2000

OR

SELECT distinctcount(sessionguid) FROM web_session_records WHERE appkey = "AD-AAB-AAF-XCP" LIMIT 2000

Thanks,

Chitra

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...