Splunk Search

How search and list the same session ID's occurring in two or more hosts?

pavanae
Builder

Hi

I have fields created for both sessionId and host. Now I wanna find out the same sessionId happening in two different hosts and list them:

search: index="atg" sessionId="*mob" host="*"

sessionId example =16E4E8BA9480F388B11B3FC35B07732E.svcldprdapp06b-33mob

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

index="atg" sessionId="*mob" host="*" | stats dc(host) as hostCount values(host) as hosts by sessionId | where hostCount>=2

View solution in original post

ermanoj21yadav
Explorer

What if I want to plot it on a graph on timechart like how many sessionIds had more than 1 hosts over a specific period of time

0 Karma

somesoni2
Revered Legend

Try something like this

index="atg" sessionId="*mob" host="*" | stats dc(host) as hostCount values(host) as hosts by sessionId | where hostCount>=2

pavanae
Builder

Thanks worked great

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...