Splunk Search

How to return first 2 events in a httpSession?

cheriemilk
Path Finder

Hi team,

I have below sample raw data in splunk: 

Spoiler
2020-10-27 06:43:56.351 action=view_page httpSessionID = 11
2020-10-27 06:43:57.351 action=click_create_button  httpSessionID = 11
2020-10-27 06:43:58.351 action=save  httpSessionID = 11
2020-10-28 03:33:33.351 action=view_page  httpSessionID = 22
2020-10-28 03:33:34.351 action=filter  httpSessionID = 22
2020-10-28 03:33:35.351 action=update  httpSessionID = 22
2020-10-29 01:11:11.351 action=view_page  httpSessionID = 33

the number of event in a httpSessionID is dynamic. For example: it could be 1, 2, 3, 4....10...20 etc..

Now I want splunk to return me the first two events in a httpSessionID,  how the query  should be?

Thanks,

Cherie

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Hi @cheriemilk 

Did you try what I suggested?

The streamstats will effectively add a count to each event within a session i.e the first event for session A will have a row of 1, the second will have a row of 2, and the first event for session B will have a row of 1 etc. Therefore, the only events with row less than 3 are the first two event for each session. You may need to do a reverse beforehand otherwise you may end up with the last two in each session 

| reverse
| streamstats count as row by sessionId
| where row < 3

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats count as row by sessionId
| where row < 3
0 Karma

cheriemilk
Path Finder

Hi @ITWhisperer  I want it return first 2 events in every httpSession, instead of filtering out the sessions where there're less than 3 events. 

 

Thanks,

Cherie

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Hi @cheriemilk 

Did you try what I suggested?

The streamstats will effectively add a count to each event within a session i.e the first event for session A will have a row of 1, the second will have a row of 2, and the first event for session B will have a row of 1 etc. Therefore, the only events with row less than 3 are the first two event for each session. You may need to do a reverse beforehand otherwise you may end up with the last two in each session 

| reverse
| streamstats count as row by sessionId
| where row < 3
0 Karma

cheriemilk
Path Finder

@ITWhisperer  

You're right. I ever thought streamstats count as row by sessionID is to count the number of events in a session.

Thanks,

Cherie

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...