How to Keep Fields from Becoming Multivalued

[Traer001]

Hello,

I have events like this:

2021-06-07 17:53:01 UserId:123 Session complete
2021-06-07 17:25:01 UserId:123 Start session
2021-06-07 17:17:01 UserId:123 Choose location for session:231
2021-06-07 15:33:01 UserId:123 Session complete
2021-06-07 14:55:01 UserId:123 Start session
2021-06-07 14:42:01 UserId:123 Choose location for session:212

I created a search the takes note of the session number and then uses a transaction to calculate the duration from the start of the session to its completion. Then I show the results in a table. Everything has a single value and appears to be accurate when I run the search with a time range of less than a day.

HOWEVER, when I run the search with a time range of more than a couple of days it then starts to put multiple session numbers together in the field for one instance and also calculates the duration by adding the two durations together, throwing off my results.

When the time range is smaller it shows something like:

user_id         session_id         session_start                         session_end                          duration
123                 212                      2021-06-07 14:55:01         2021-06-07 15:33:01       00:38:00
123                 231                      2021-06-07 17:25:01         2021-06-07 17:53:01       00:28:00

When the time range is larger than a couple of days some of my data will look like this:

User_id          session_id         session_start                       session_end                          duration
123                  212                      2021-06-07 14:55:01       2021-06-07 17:53:01       02:58:00
                          231

How can I go about either preventing this? Or is there a way I can filter out any multivalue fields like this?

Thanks for any help!

[venkatasri · Accepted solution]

Hi @Traer001 

The data looks like it shall group by user_id, session_id. Try  | transaction user_id session_id with additional args (maxspan, maxpause, startswith ends*) that you require. Do not set mvlist=true for your case.

If you can share the SPL that would help to troubleshoot in case above recommendation doesn't work.

------------

An upvote would be appreciated if it helps!