Splunk Search

Two searches combined including transaction

Contributor

The below gives me the correct number of hits per external user

sourcetype="iis-2" | extract auto=true | search COREemployee="F*" | stats count(csuristem) AS Hits by csusername date | fields date cs_username Hits

The second search below gives me the roughly correct number of visits per user, I need to refine it slightly.

sourcetype="iis-2" | extract auto=true | search COREemployee="F*" | transaction csusername maxspan=30m | stats count AS Visits by csusername date | fields date csusername Visits

How would I combine the two into one search that would result in a table

date, cs_username, Hits, Visits

0 Karma

Motivator

I reread your question and updated my search to address request more accurately. One way would be the append command, with some eval and possibly stats usage as well. The key is making each search have the same columns. How about something like this:

sourcetype="iis-2" 
    | extract auto=true 
    | search CORE_employee="F*" 
    | eval Visits=0 
    | stats count(cs_uri_stem) AS "Hits", sum(Visits) as "Visits" by cs_username date 
    | fields date cs_username Hits Visits 
| append [search sourcetype="iis-2" 
    | extract auto=true 
    | search CORE_employee="F*" 
    | transaction cs_username maxspan=30m 
    | eval Hits=0 
    | stats count AS "Visits", sum(Hits) as "Hits" by cs_username date 
    | fields date cs_username Hits Visits ] 
| stats sum(Hits) as "Hits", sum(Visits) as "Visits" by date, cs_username 

Does this do what you need?

Contributor

Sorry for the late reply, this does seem to work for some months and not others, I'll investigate a bit and see what the issue is. Thanks for the response.

0 Karma