Dynamic lookups?

[twinspop]

Log stream looks like this:

session=1234567 client=acme start
sltsession=abcdef continuing page=1
sltsession=abcdef continuing page=2
sltsession=abcdef continuing page=2
sltsession=abcdef continuing page=1

The sltsession value is created using eval and md5() with the session and client values. What I want is a table of each page log by the client value, but I'm failing to see how to map the eval'd sltsession field with the client field on all subsequent logs past the 1st. I want a table similar to this:

acme start
acme page 1
acme page 2
acme page 2
acme page 1

Thanks,

Jon

[lguinn2]

Could you do this

yoursearchhere
| eval sltsession = if(notnull(sltsession), md5(session + client), sltsession)
| transaction sltsession
| stats values(page) as Pages by client session

[lguinn2]

list() is not supposed to dedup...

You might also see what

| table client session page

would do instead of the stats command

[twinspop]

It's close, but the list() and values() stats functions de-dup the values. 😕