Splunk Search

How can I get a usage count of all the user sessions that are NOT sticking to one host without providing "session id" in search box?

Pravinraju
New Member

index="inx_prod" host="pweb*" "session_id=4w344fbrz5th1pzfatvb0u3u" | table host, session_id | stats count by host, session_id

The above query provides result as below :

host | session_id | count

pweb01 | 4w344fbrz5th1pzfatvb0u3u | 10
pweb02 | 4w344fbrz5th1pzfatvb0u3u | 8
pweb01 | 98ashdsssswaeiluhawdhn56 | 4
pweb02 | 98ashdsssswaeiluhawdhn56 | 20

I want to get a session ids that is associated with the different servers, thereby not using the "session_id" in the search box !

Tags (1)
0 Karma

elliotproebstel
Champion

If you want to find session_id values that are seen in logs across multiple hosts, you can use the dc() function in stats to count the distinct number of host values seen per session_id like this:

index="inx_prod" host="pweb*"
| stats dc(host) AS host_count BY session_id
| where host_count>1

And if you want to preserve what those host values were, so you have the host names as well as the count:

index="inx_prod" host="pweb*"
| stats dc(host) AS host_count, values(host) AS host BY session_id
| where host_count>1
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...