Session duration calculation

[dbcase]

Hi,

I have this data

    Time    Event
11/13/17
5:12:53.000 PM  
{   [-] 
     analyticType:   SessionEnd 
     buildTarget:    comcast    
     clientSessionId:    DXCRKSZ-ANLDDLZ    
}

11/13/17
4:22:02.000 PM  
{   [-] 
     Properties:    {   [+] 
    }   
     analyticType:   SessionStart   
     buildTarget:    comcast    
     clientSessionId:    DXCRKSZ-ANLDDLZ    
}

There are a lot of different session ID's each one is unique this is just a snippet example. What I'd like to do is to compute the session duration time. Is there a way to do this with the stats command?

[micahkemp · Accepted solution]

Try this:

| stats min(_time) AS session_earliest, max(_time) AS session_latest, values(analyticType) AS analyticType BY clientSessionId
| search analyticType=sessionStart analyticType=sessionEnd
| eval duration=session_latest-session_earliest
| stats avg(duration)

If there is more than one event per clientSessionId with analyticType=sessionStart, this may give incorrect results, but I did at least try to ensure that only sessions with a Start and End were considered.

[dbcase]

Hi Micahkemp,

Yea there are several sessions that have multiple starts and ends during the time range...... Guess using transaction might be the best way to do this???

[dbcase]

I tried this query and I think it works but still would like to see if this can be done with the stats command

index=wholesale_app analyticType=sessionStart OR analyticType=sessionEnd |transaction clientSessionId startswith="sessionStart" endswith="sessionEnd"|stats avg(duration)