How to return first 2 events in a httpSession?

[cheriemilk]

Hi team,

I have below sample raw data in splunk: 

Spoiler

2020-10-27 06:43:56.351 action=view_page httpSessionID = 11
2020-10-27 06:43:57.351 action=click_create_button  httpSessionID = 11
2020-10-27 06:43:58.351 action=save  httpSessionID = 11
2020-10-28 03:33:33.351 action=view_page  httpSessionID = 22
2020-10-28 03:33:34.351 action=filter  httpSessionID = 22
2020-10-28 03:33:35.351 action=update  httpSessionID = 22
2020-10-29 01:11:11.351 action=view_page  httpSessionID = 33

the number of event in a httpSessionID is dynamic. For example: it could be 1, 2, 3, 4....10...20 etc..

Now I want splunk to return me the first two events in a httpSessionID,  how the query  should be?

Thanks,

Cherie

[ITWhisperer]

| streamstats count as row by sessionId
| where row < 3

[cheriemilk]

Hi @ITWhisperer  I want it return first 2 events in every httpSession, instead of filtering out the sessions where there're less than 3 events. 

Thanks,

Cherie

[ITWhisperer · Accepted solution]

Hi @cheriemilk 

Did you try what I suggested?

The streamstats will effectively add a count to each event within a session i.e the first event for session A will have a row of 1, the second will have a row of 2, and the first event for session B will have a row of 1 etc. Therefore, the only events with row less than 3 are the first two event for each session. You may need to do a reverse beforehand otherwise you may end up with the last two in each session 

| reverse
| streamstats count as row by sessionId
| where row < 3

[cheriemilk]

@ITWhisperer  

You're right. I ever thought streamstats count as row by sessionID is to count the number of events in a session.

Thanks,

Cherie