Splunk Search

Extract and count IDs from a table

wkk
Explorer

Hi! 🙂 

I have a fallowing table:

SESSION_IDSUBMITTED_FROMSTAGE
1 submit
1startPagesomeStage1
2 submit
2page1someStage1
2page2someStage2


How could I count the number of SESSION_IDs that has SUBMITTED_FROM=startPage and STAGE=submit?

So looking at the above table the outcome of that logic should be SESSION_IDs

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @wkk,

you could try something like this:

index=your_index
| stats 
   values(SUBMITTED_FROM) AS SUBMITTED_FROM
   values(STAGE) AS STAGE
   BY SESSION_ID
| mvexpand SUBMITTED_FROM
| mvexpand STAGE
| search SUBMITTED_FROM=startPage STAGE=submit
| stats count BY SESSION_ID

Ciao.

Giuseppe

View solution in original post

wkk
Explorer

I slightly changed the query, as I didn't want to use search. Query ends up with the same results.

index=your_index
| stats 
   values(SUBMITTED_FROM) AS SUBMITTED_FROM
   values(STAGE) AS STAGE
   BY SESSION_ID
| where SUBMITTED_FROM=startPage STAGE=submit
| stats count BY SESSION_ID

 

0 Karma

wkk
Explorer

@gcusello thank you that solved my case 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @wkk,

you could try something like this:

index=your_index
| stats 
   values(SUBMITTED_FROM) AS SUBMITTED_FROM
   values(STAGE) AS STAGE
   BY SESSION_ID
| mvexpand SUBMITTED_FROM
| mvexpand STAGE
| search SUBMITTED_FROM=startPage STAGE=submit
| stats count BY SESSION_ID

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @wkk ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Hi Splunky people! We are excited to share the newest updates in Splunk Enterprise 9.3!Admins and Analyst can ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...