Splunk Search

How to Keep Fields from Becoming Multivalued

Traer001
Path Finder

Hello,

I have events like this:

2021-06-07 17:53:01 UserId:123 Session complete
2021-06-07 17:25:01 UserId:123 Start session
2021-06-07 17:17:01 UserId:123 Choose location for session:231
2021-06-07 15:33:01 UserId:123 Session complete
2021-06-07 14:55:01 UserId:123 Start session
2021-06-07 14:42:01 UserId:123 Choose location for session:212

 

I created a search the takes note of the session number and then uses a transaction to calculate the duration from the start of the session to its completion. Then I show the results in a table. Everything has a single value and appears to be accurate when I run the search with a time range of less than a day.

HOWEVER, when I run the search with a time range of more than a couple of days it then starts to put multiple session numbers together in the field for one instance and also calculates the duration by adding the two durations together, throwing off my results.

When the time range is smaller it shows something like:

user_id         session_id         session_start                         session_end                          duration
123                 212                      2021-06-07 14:55:01         2021-06-07 15:33:01       00:38:00
123                 231                      2021-06-07 17:25:01         2021-06-07 17:53:01       00:28:00

 

When the time range is larger than a couple of days some of my data will look like this:

User_id          session_id         session_start                       session_end                          duration
123                  212                      2021-06-07 14:55:01       2021-06-07 17:53:01       02:58:00
                          231

 

How can I go about either preventing this? Or is there a way I can filter out any multivalue fields like this?

Thanks for any help!

Labels (2)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @Traer001 

The data looks like it shall group by user_id, session_id. Try  | transaction user_id session_id with additional args (maxspan, maxpause, startswith ends*) that you require. Do not set mvlist=true for your case.

If you can share the SPL that would help to troubleshoot in case above recommendation doesn't work.

------------

An upvote would be appreciated if it helps!

View solution in original post

venkatasri
SplunkTrust
SplunkTrust

Hi @Traer001 

The data looks like it shall group by user_id, session_id. Try  | transaction user_id session_id with additional args (maxspan, maxpause, startswith ends*) that you require. Do not set mvlist=true for your case.

If you can share the SPL that would help to troubleshoot in case above recommendation doesn't work.

------------

An upvote would be appreciated if it helps!

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...