There are multiple events with 1 same field - unique_session, how to combine and count events from that unique session and get statistical data?
Some sample events and your desired outcome would be helpful.
You can do
index=<your index>| stats count by user unique_session
this search will return all events - I need just the once that has same unique_session
| transaction unique_session will tell you how many events there are and how long the session lasted.
| transaction unique_session
I am getting results but it seems like not exactly correct ones. I am trying to combine and count event1 and event2 with same unique_session. But getting counts where only event2 or event1 are present
example of a search event1=1 OR event2=2 | transaction unique_session | stats count by user
Result returns users with event1 and event2
