Grouping by two fields, want to get distinct count of values in second field

[jbrenner]

Hi,

I wrote the following Splunk query which returns a list of distinct USER_AGENTs for each SESSION_ID:

index=abc | rex field=_raw "-S:(?<SESSION_ID>\w+)-.+User agent: '(?<USER_AGENT>.+)', Referrer" | stats count by SESSION_ID, USER_AGENT

I would now like to modify this query to return a list of SESSION_IDs that have more than one unique value for USER_AGENT, and the count of the unique values.

Thanks!
Jonathan

[somesoni2 · Accepted solution]

Try this

index=abc | rex field=_raw "-S:(?<SESSION_ID>\w+)-.+User agent: '(?<USER_AGENT>.+)', Referrer" | stats dc(USER_AGENT) as USER_AGENTs by SESSION_ID | where USER_AGENTs>1

[jbrenner]

That worked.
Thanks!