Splunk Search

How can I get a usage count of all the user sessions that are NOT sticking to one host without providing "session id" in search box?

New Member

index="inx_prod" host="pweb*" "session_id=4w344fbrz5th1pzfatvb0u3u" | table host, session_id | stats count by host, session_id

The above query provides result as below :

host | session_id | count

pweb01 | 4w344fbrz5th1pzfatvb0u3u | 10
pweb02 | 4w344fbrz5th1pzfatvb0u3u | 8
pweb01 | 98ashdsssswaeiluhawdhn56 | 4
pweb02 | 98ashdsssswaeiluhawdhn56 | 20

I want to get a session ids that is associated with the different servers, thereby not using the "session_id" in the search box !

Tags (1)
0 Karma


If you want to find session_id values that are seen in logs across multiple hosts, you can use the dc() function in stats to count the distinct number of host values seen per session_id like this:

index="inx_prod" host="pweb*"
| stats dc(host) AS host_count BY session_id
| where host_count>1

And if you want to preserve what those host values were, so you have the host names as well as the count:

index="inx_prod" host="pweb*"
| stats dc(host) AS host_count, values(host) AS host BY session_id
| where host_count>1
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...