How can I get a usage count of all the user sessions that are NOT sticking to one host without providing "session id" in search box?

[Pravinraju]

index="inx_prod" host="pweb*" "session_id=4w344fbrz5th1pzfatvb0u3u" | table host, session_id | stats count by host, session_id

The above query provides result as below :

host | session_id | count

pweb01 | 4w344fbrz5th1pzfatvb0u3u | 10
pweb02 | 4w344fbrz5th1pzfatvb0u3u | 8
pweb01 | 98ashdsssswaeiluhawdhn56 | 4
pweb02 | 98ashdsssswaeiluhawdhn56 | 20

I want to get a session ids that is associated with the different servers, thereby not using the "session_id" in the search box !

[elliotproebstel]

If you want to find session_id values that are seen in logs across multiple hosts, you can use the dc() function in stats to count the distinct number of host values seen per session_id like this:

index="inx_prod" host="pweb*"
| stats dc(host) AS host_count BY session_id
| where host_count>1

And if you want to preserve what those host values were, so you have the host names as well as the count:

index="inx_prod" host="pweb*"
| stats dc(host) AS host_count, values(host) AS host BY session_id
| where host_count>1