Splunk Search

How to count events by values from related events?

maclun
New Member

Hi,

There is a web app that has an 'init' event on load. It carried current 'version' and 'sessionId'.
All other events have 'sessionId' attribute. E.g:
init:
{version: '1.2.3', sessionId: 'asdd-asdd-wqed-wqed'}
any event:
{sessionId: 'asdd-asdd-wqed-wqed', userId: 4123}

I would like to know how many users are on which version.
It could be that there are many init events per user - when they reload the page. Could also be that those init events have different versions if the web app has been updated in the meantime.

I would appreciate if you could tell me how to achieve this, or at least point me to some direction (functions, examples).

Cheers!

0 Karma

somesoni2
Revered Legend

Try something like this

your base search | table version sessionId userId | eventstats values(version) as version by sessionId | stats dc(userId) as count by version
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...