Splunk Search

How to search the total distinct count on two different fields?

jameskerivan
Explorer

Hi,

This is kind of a silly question, but currently my application is logging the session id as two separate fields, Session_id and sessionId. Now sometimes either of the session ids can be NA. I want to find the total unique session id's for my search based on those 2 fields. An example would be like

session_id = 2 sessionId = 2
session_id = NA sessionId = 3
session_id=1 sessionId = NA

So my count would be 4 with counts for {2, NA, 3, 1}

Thanks so much!

0 Karma

chanmi2
Path Finder

Try this:

your search | eval combine_session = session_id.",".sessionID | makemv delim = "," combine_session | stats dc(combine_session), values(combine_session)
0 Karma

justinatpnnl
Communicator

Normally you would use the COALESCE function for this, but if the session_id literally has the string "NA" then that poses a problem.

I would probably attack it like this:

<your search here>
| eval new_session_id  = case(isnum(session_id), session_id, isnum(sessionID), sessionID, 1==1, "NA")
| stats dc(new_session_id)
0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...