Splunk Search

How to return a field that isn't part of the stats count?

markwymer
Path Finder

Hi,

I'm trying to get a table of all the Session_ID values when the count of Logon_IDs is more than 2, but since the stats count is based on the number of Logon_IDs, the Session_ID field is no longer available for me to table.

For example:

Data=
Logon_IDs       Session_ID
Jones           sess_1
Smith           sess_2
Brown           sess_3
Smith           sess_4

My first attempt was stats count BY Logon_IDs" | where count > 1 | table Session_ID, but this removes the Session_ID field.

What SPL should I be using to get the result:

Session_ID
sess_2
sess_4

Many thanks,
Mark.

0 Karma

sundareshr
Legend

Try this

.... | stats values(loginid) as lid count by sessionid | where mvcount(lid)>1
0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...