Splunk Search

How do you combine two fields from a username search into one field?



I'm having an issue trying to combine a field into one when searching a separate field. I have tried two separate searches, but I do not get results from either of them.

index=iis_aps cs_username!="-"| eval session1=coalesce(ASP_NET_SessionId,TransID) | stats count(session1) by cs_username

index=iis_apps | eval sessiongrp=case(ASP_NET_SessionId="*", "aspsess", TransID="*", "trans", 1=1, "Not Found") | stats list(host) by sessiongrp 

I am trying to get the session id and transid from the results of searching for cs_username. So that the result would show the username and then the session id or transid. I am not sure what I am doing wrong. Any help is appreciated.

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

hi @synking

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma


Try something like this...

  index=iis_aps cs_username!="-" (ASP_NET_SessionId=* OR TransID=*) 
 | eval sessiongrp=case(isnotnull(ASP_NET_SessionId), "aspsess", isnotnull(TransID), "trans") 
 | stats values(ASP_NET_SessionId) as ASP_NET_SessionId  dc((ASP_NET_SessionId) as SessionId_Count 
    values(TransID) as TransID dc(TransID) as TransID_Count 
    values(sessiongrp) as sessiongrp by cs_username
0 Karma


Hey thanks for the answer. When I use this search I still get nothing back. I show 0 events match and then no results found.

I am not sure what I am doing wrong. Thanks for the help.

0 Karma

Ultra Champion

Can you perhaps create a mock up of the results (or explain a bit better what the result is that you are looking for)? That is still a bit unclear to me.

If you just want a table with the session1 and cs_username fields, just do | table session1,cs_username instead of the stats count.

0 Karma


I am trying to get only the stats of cs_username if it also has either TransID or ASP_NET_SessionId. For some reason when I try my above searchs I get zero results but if I search just aspid or trans id I get info.

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...