Splunk Search

Compare fields in a table

ejread
Explorer

I have a table generated from two fields, sessionid and host -

... | stats count by sessionid host

I am trying to find only the sessionids that appear on more than one host. So basically, I need to compare each sessionid/host pair that appears in the logs with subsequent pairs for the same sessionid, but a different host.

Tags (1)
0 Karma

ldurrani
New Member

This will give you what you are looking for.

... | transaction pdsessionid maxspan=30s maxpause=5s | eval hcount = mvcount(host) | where hcount > 1

0 Karma

gkanapathy
Splunk Employee
Splunk Employee
 ... | stats count by sessionid host | eventcount dc(host) as hc by sessionid | where hc >= 2

or you could do:

... | values(host) as hosts by sessionid | where mvcount(hosts) >= 2

but that gives you a less flexible set of results.

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...