How do you combine two fields from a username search into one field?

[synking]

Hey,

I'm having an issue trying to combine a field into one when searching a separate field. I have tried two separate searches, but I do not get results from either of them.

index=iis_aps cs_username!="-"| eval session1=coalesce(ASP_NET_SessionId,TransID) | stats count(session1) by cs_username

index=iis_apps | eval sessiongrp=case(ASP_NET_SessionId="*", "aspsess", TransID="*", "trans", 1=1, "Not Found") | stats list(host) by sessiongrp 

I am trying to get the session id and transid from the results of searching for cs_username. So that the result would show the username and then the session id or transid. I am not sure what I am doing wrong. Any help is appreciated.

[mstjohn_splunk]

hi @synking

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

[DalJeanis]

Try something like this...

  index=iis_aps cs_username!="-" (ASP_NET_SessionId=* OR TransID=*) 
 | eval sessiongrp=case(isnotnull(ASP_NET_SessionId), "aspsess", isnotnull(TransID), "trans") 
 | stats values(ASP_NET_SessionId) as ASP_NET_SessionId  dc((ASP_NET_SessionId) as SessionId_Count 
    values(TransID) as TransID dc(TransID) as TransID_Count 
    values(sessiongrp) as sessiongrp by cs_username

[synking]

Hey thanks for the answer. When I use this search I still get nothing back. I show 0 events match and then no results found.

I am not sure what I am doing wrong. Thanks for the help.

[FrankVl]

Can you perhaps create a mock up of the results (or explain a bit better what the result is that you are looking for)? That is still a bit unclear to me.

If you just want a table with the session1 and cs_username fields, just do | table session1,cs_username instead of the stats count.

[synking]

I am trying to get only the stats of cs_username if it also has either TransID or ASP_NET_SessionId. For some reason when I try my above searchs I get zero results but if I search just aspid or trans id I get info.