Splunk Search

Search for Access Page Tracking

melonman
Motivator

Hi,

I think this is similar case as user URL tracking on web sites,
and I am trying to track what page a user have visited.

Here is my log (simplified).
This includes user, previous page, current page and timestamp in unix time.

1361836690 user=u01 action=move prev=p1 current=p2
1361836690 user=u02 action=move prev=p2 current=p4
1361836691 user=u01 action=move prev=p2 current=p3
1361836691 user=u02 action=move prev=p5 current=p6
1361836691 user=u03 action=move prev=p2 current=p1
1361836692 user=u02 action=move prev=p5 current=p6
1361836693 user=u03 action=move prev=p1 current=p3
1361836696 user=u01 action=move prev=p3 current=p4
1361836698 user=u03 action=move prev=p3 current=p4
1361836699 user=u03 action=move prev=p5 current=p6
1361836708 user=u03 action=move prev=p6 current=p1

What I want to do is to list which page a user has visited by connecting prev in a event and current in the next latest event that matches to prev value in a last event.

I think SQL can query such information, but I need to do this by Splunk Language.

I would like to get some help with this from anyone who knows this type of search.

Thank you in advance,

Tags (2)
0 Karma
1 Solution

Splunk_Shinobi
Splunk Employee
Splunk Employee

How about this?

sourcetype=atype
| eval t=_time 
| convert ctime(t) 
| eval a="(".t.") ".prev."->".current 
| eval p=prev.",".current 
| makemv delim="," p 
| transaction user p 
| table user a


user              a
---- ----------------------------
u01  (02/26/2013 08:58:10) p1->p2
     (02/26/2013 08:58:11) p2->p3
     (02/26/2013 08:58:16) p3->p4

u02  (02/26/2013 08:58:11) p5->p6
     (02/26/2013 08:58:12) p5->p6

u02  (02/26/2013 08:58:10) p2->p4

u03  (02/26/2013 08:58:19) p5->p6
     (02/26/2013 08:58:28) p6->p1

u03  (02/26/2013 08:58:11) p2->p1
     (02/26/2013 08:58:13) p1->p3
     (02/26/2013 08:58:18) p3->p4

View solution in original post

melonman
Motivator

I want to connect/join on prev and current values. I am trying to figure out how to use selfjoin command to a pair of keys in a separated events.

0 Karma

Splunk_Shinobi
Splunk Employee
Splunk Employee

How about this?

sourcetype=atype
| eval t=_time 
| convert ctime(t) 
| eval a="(".t.") ".prev."->".current 
| eval p=prev.",".current 
| makemv delim="," p 
| transaction user p 
| table user a


user              a
---- ----------------------------
u01  (02/26/2013 08:58:10) p1->p2
     (02/26/2013 08:58:11) p2->p3
     (02/26/2013 08:58:16) p3->p4

u02  (02/26/2013 08:58:11) p5->p6
     (02/26/2013 08:58:12) p5->p6

u02  (02/26/2013 08:58:10) p2->p4

u03  (02/26/2013 08:58:19) p5->p6
     (02/26/2013 08:58:28) p6->p1

u03  (02/26/2013 08:58:11) p2->p1
     (02/26/2013 08:58:13) p1->p3
     (02/26/2013 08:58:18) p3->p4

melonman
Motivator

Is there any other way without using transaction command? I think there is a event count limitation that transaction command can handle...?

0 Karma

vincesesto
Communicator

Hey Melonman,

Just a little bit more information if you could. Are you wanting to do the self join on the user value or on the prev and current values...There is a selfjoin search function within splunk and more info can be found at:
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Selfjoin

Regards,

Vince

0 Karma

melonman
Motivator

Rephrasing my question, is there any way to do self join by Splunk Language?

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...