Splunk Search

What is most efficient way to join 2 broken sources?

P3P4
New Member

Hi,

I have 2 sources of data.
One contains visitor statistics similar to this format:
visitorID="154";visitorName="Bob";visitorCreated="5/6/2012"

Other one contains visitor actions similar to this format:
actionID="57798";actionVisitorID="154";actionTitle="forum comment";actionCreated="6/6/2012"

What I'm looking for is to create report with most active visitors over span of two years. Each visitor can have up to 1000 actions and there are more than 60000 visitors per day on average.

Firstly, each visitor has multiple records spanning over long period, therefore I cannot create event correlation over time.

Secondly, some records are broken. Not every action has corresponding visitor and vice versa. I would like to create report only on those records which are not broken.

I was thinking of something like this:

source=visitor [search source=action [search source=visitor | rename visitorID as actionVisitorID] | top actionVisitorID | rename actionVisitorID as visitorID]

In other words: search for actions, but limit only those which has matching visitors and get me only most active. Then project results to visitor and display most active visitor records.

Cheers

Tags (2)
0 Karma

eashwar
Communicator

you can use OR to do the job

source=visitor OR source=action | rex field=actionVisitorID "^(?P<visitorID>\d+)" | top visitorID

you can also use rename actionVisitorID AS visitorID instead of using rex.

finish your search by | top visitorID

or you can also do a transaction if you want to group the events by visitorID

| transaction visitorID

i hope now you can find the most active users beased on the eventcount or the mvcount of the data field.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...