Splunk Search

Dynamic lookups?

Influencer

Log stream looks like this:

session=1234567 client=acme start
sltsession=abcdef continuing page=1
sltsession=abcdef continuing page=2
sltsession=abcdef continuing page=2
sltsession=abcdef continuing page=1

The sltsession value is created using eval and md5() with the session and client values. What I want is a table of each page log by the client value, but I'm failing to see how to map the eval'd sltsession field with the client field on all subsequent logs past the 1st. I want a table similar to this:

acme start
acme page 1
acme page 2
acme page 2
acme page 1

Thanks,

Jon

Tags (2)
0 Karma

Legend

Could you do this

yoursearchhere
| eval sltsession = if(notnull(sltsession), md5(session + client), sltsession)
| transaction sltsession
| stats values(page) as Pages by client session
0 Karma

Legend

list() is not supposed to dedup...

You might also see what

| table client session page

would do instead of the stats command

0 Karma

Influencer

It's close, but the list() and values() stats functions de-dup the values. 😕

0 Karma