Visited website duration

[bryansocito]

Hi Everyone,

I have the query below and it works, however I would like to add the time spend on each website/domain visited. how to do that?

index=mc_proxy sourcetype=mc_proxy client_ip=$ip_token$ | stats count by domain | sort - count

Cheers!
Bry

[schose · Accepted solution]

Hi,

index=mc_proxy sourcetype=mc_proxy client_ip=$ip_token$ | transaction domain client_ip | table _time domain client_ip duration

.. should do the job!

regards,

Andreas