Splunk Search

Dynamic lookups?

twinspop
Influencer

Log stream looks like this:

session=1234567 client=acme start
sltsession=abcdef continuing page=1
sltsession=abcdef continuing page=2
sltsession=abcdef continuing page=2
sltsession=abcdef continuing page=1

The sltsession value is created using eval and md5() with the session and client values. What I want is a table of each page log by the client value, but I'm failing to see how to map the eval'd sltsession field with the client field on all subsequent logs past the 1st. I want a table similar to this:

acme start
acme page 1
acme page 2
acme page 2
acme page 1

Thanks,

Jon

Tags (2)
0 Karma

lguinn2
Legend

Could you do this

yoursearchhere
| eval sltsession = if(notnull(sltsession), md5(session + client), sltsession)
| transaction sltsession
| stats values(page) as Pages by client session
0 Karma

lguinn2
Legend

list() is not supposed to dedup...

You might also see what

| table client session page

would do instead of the stats command

0 Karma

twinspop
Influencer

It's close, but the list() and values() stats functions de-dup the values. :confused_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...