Splunk Search

How to count events by values from related events?

maclun
New Member

Hi,

There is a web app that has an 'init' event on load. It carried current 'version' and 'sessionId'.
All other events have 'sessionId' attribute. E.g:
init:
{version: '1.2.3', sessionId: 'asdd-asdd-wqed-wqed'}
any event:
{sessionId: 'asdd-asdd-wqed-wqed', userId: 4123}

I would like to know how many users are on which version.
It could be that there are many init events per user - when they reload the page. Could also be that those init events have different versions if the web app has been updated in the meantime.

I would appreciate if you could tell me how to achieve this, or at least point me to some direction (functions, examples).

Cheers!

0 Karma

somesoni2
Revered Legend

Try something like this

your base search | table version sessionId userId | eventstats values(version) as version by sessionId | stats dc(userId) as count by version
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...