Yes you are correct. I am trying to find if there are any repeated requests to that particular uri.
i got the results but i am seeing the count as 1 and there is no single event with count as 2, which is not believable. I am still digging thru the data.
Without knowing sample logs or available fields, give this a try
your base search | transaction sessionId uri ...transaction attributes... | stats count by sessionId uri
The transaction command is costly, so if you can provide some sample events and/or available field names, we can suggest something more efficient.
Thank you. our session id is jsessionid and uri is uri_path
I am trying this but i am not getting any data
sourcetype=access_combined_cookie host=pr* uri_path="/home" | transaction jsessionid uri_path | stats count by jsessionid uri_path
And you're getting any result with your base search?
Also, could you provide more details on your requirement here? Do you want to count how many times a uri_path appears for a jsessionid value?