Splunk Search

How can I get a usage count of all the user sessions that are NOT sticking to one host without providing "session id" in search box?

New Member

index="inx_prod" host="pweb*" "session_id=4w344fbrz5th1pzfatvb0u3u" | table host, session_id | stats count by host, session_id

The above query provides result as below :

host | session_id | count

pweb01 | 4w344fbrz5th1pzfatvb0u3u | 10
pweb02 | 4w344fbrz5th1pzfatvb0u3u | 8
pweb01 | 98ashdsssswaeiluhawdhn56 | 4
pweb02 | 98ashdsssswaeiluhawdhn56 | 20

I want to get a session ids that is associated with the different servers, thereby not using the "session_id" in the search box !

Tags (1)
0 Karma


If you want to find session_id values that are seen in logs across multiple hosts, you can use the dc() function in stats to count the distinct number of host values seen per session_id like this:

index="inx_prod" host="pweb*"
| stats dc(host) AS host_count BY session_id
| where host_count>1

And if you want to preserve what those host values were, so you have the host names as well as the count:

index="inx_prod" host="pweb*"
| stats dc(host) AS host_count, values(host) AS host BY session_id
| where host_count>1
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...