I have the following result from a simple search:
I, [2015-07-23T15:30:39+02:00 (1437658239.654) #38640] INFO -- ccceedb1a97f382d192a93fab686319b [...] "GET /?sid=ccceedb1a97f382d192a93fab686319b [...] https://[...]?sid=756a0279d436826f3ad51ba00f49d65d" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 (PSBrowserEmbedded) Safari/537.36" [...]
(part of the search result hidden due to confidentiality requirements)
However, it is not a normal behavior of the system for 'sid' to have two different values in one result. So I'm trying to find all results for a certain time frame where there are multiple values (i.e. more than one unique value) of 'sid' in one result. I'm guessing it should be something similar to this:
But in one result.
How can I do this?
However, this doesn't seem to work for me. The search brings me no results (having the same time range as the initial search).
I was thinking it might be a bit more complex search, but am open to try any other suggestions.
If Splunk is already identifying the field 'sid' for you as multivalued field for events having multiple values of it, try this:-
your base search | where mvcount(sid)=2 AND mvindex(sid,0)!=mvindex(sid,1)
If the field sid is not extracted by Splunk automatically, try this
your base search | rex max_match=0 "sid=(?<sid>\w+)" | where mvcount(sid)=2 AND mvindex(sid,0)!=mvindex(sid,1)
Thank you somesoni2,
Your answer seems to have worked best for me and returns results as I needed. Apparently, 'sid' is not extracted automatically by Splunk, so I had to use the second suggestion.
Thanks to everyone for looking into this.
U can use
|transaction command which will group with respect to session ID's..
your base search | rex "(?im)sid=(?\w+)" | transaction sid | stats count by sid
Hope it will help.