I want to make a search that will return a count of sessionid based on the following fields
I want a count of how many sessions have an event with the loggedin field existing & the logged_out field not existing, this way I can tell exactly how many sessions are currently online.
How would I compare based on a field not existing, I tried isnull() and it didn't work as needed.
YOUR_SEARCH | eval flag=if(logged_in=="Yes" AND isnull(logged_out),1,0) | stats sum(flag)
| makeresults | eval logged_in="Yes",logged_out="Yes" | append [| makeresults | eval logged_in="Yes"] | eval flag=if(logged_in=="Yes" AND isnull(logged_out),1,0) | stats sum(flag)
@ialahdal You can do something like below.
<your search query> | stats count(eval(ISNOTNULL(logged_in))) as in_count , count(eval(ISNOTNULL(logged_out)) as out_count by SessionID| where in_count > out_count
Thanks to you and @kamlesh_vaghela, I think isnull is making values null, using isnotnull like you mentioned did get me to the results I needed eventually.