Splunk Search

How to use the stats command to get the sums of 3 fields and the count of sessions IDs by user in one table?

lmaclean
Path Finder

So far I have the stats for calculating Total, Upload & Download Bandwidths by user, but then I also want to get a count of session IDs (sessionid) on the same table.:

... | stats sum(bandwidth_total) as "Bandwidth", sum(bandwidth_upload) as Upload, sum(bandwidth_download) as Download by user | sort -Bandwidth | rename Bandwidth as "Total Bandwidth"

I have tried adding a count(sessionid) to the mix, but it doesn't work and returns a "0" for that field and if I try it by itself stats count by sessionid, I get the sessionid which is just a high number then a count of "1".

So I am trying to work out search that can cover a week/month period to calculate users' bandwidth over that period, the number of sessions they had as well, and have all of this on one table if possible.

0 Karma
1 Solution

woodcock
Esteemed Legend

This should definitely work:

... | stats sum(bandwidth_total) as "Bandwidth", sum(bandwidth_upload) as Upload, sum(bandwidth_download) as Download dc(sessionid) AS SessionIDs by user | sort -Bandwidth | rename Bandwidth as "Total Bandwidth"

If it is not working then the problem is probably with the extraction of the sessionid field/value or that the logs that have sessionid do not also have user (maybe user is spelled or capitalized differently).

View solution in original post

woodcock
Esteemed Legend

This should definitely work:

... | stats sum(bandwidth_total) as "Bandwidth", sum(bandwidth_upload) as Upload, sum(bandwidth_download) as Download dc(sessionid) AS SessionIDs by user | sort -Bandwidth | rename Bandwidth as "Total Bandwidth"

If it is not working then the problem is probably with the extraction of the sessionid field/value or that the logs that have sessionid do not also have user (maybe user is spelled or capitalized differently).

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...