Splunk Search

How to count events by values from related events?

maclun
New Member

Hi,

There is a web app that has an 'init' event on load. It carried current 'version' and 'sessionId'.
All other events have 'sessionId' attribute. E.g:
init:
{version: '1.2.3', sessionId: 'asdd-asdd-wqed-wqed'}
any event:
{sessionId: 'asdd-asdd-wqed-wqed', userId: 4123}

I would like to know how many users are on which version.
It could be that there are many init events per user - when they reload the page. Could also be that those init events have different versions if the web app has been updated in the meantime.

I would appreciate if you could tell me how to achieve this, or at least point me to some direction (functions, examples).

Cheers!

0 Karma

somesoni2
Revered Legend

Try something like this

your base search | table version sessionId userId | eventstats values(version) as version by sessionId | stats dc(userId) as count by version
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...