Acceptance Criteria:
1) distinct count of user agents, and referrer url grouped by session id
2) distinct count of user ips and referrer url grouped by session id
However, the query (which I've included below) does not seem to do quite what I am trying to accomplish. According to the documentation, there is no way that the userIP field should ever be blank, yet I see numerous null values being returned.
Any ideas? Thanks in advance
| stats dc(playerUserAgent) as "Count of Unique User Agents", values(playerUserAgent) as useragents by sessionID | eval useragents = mvjoin(useragents, "|")
| join sessionID type=left [|stats dc(userIP) as "Count of Unique User IPs", values(userIP) as userIP by sessionID | eval userIP = mvjoin(userIP, "|")]
I've excluded the index and metrics I am querying for security purposes.
