dedup on Field over time span

[triva79]

we have data in Splunk for user sessions in an app and I am trying to produce a line graph to show usage every hour. the session information is added 4 times an hour so trying to remove the extra results per hour

below is an example for one user but there will be other user data as well 

userName: fred
sessionKey: a0b360d9-a471-45a1-9dcc-0dee39ed6ba8
timestamp: 2024-05-20T12:00:00Z

userName: fred
sessionKey: a0b360d9-a471-45a1-9dcc-0dee39ed6ba8
timestamp: 2024-05-20T12:30:00Z

userName: fred
sessionKey: a0b360d9-a471-45a1-9dcc-0dee39ed6ba8
timestamp: 2024-05-20T12:45:00Z

userName: fred
sessionKey: a0b360d9-a471-45a1-9dcc-0dee39ed6ba8
timestamp: 2024-05-20T13:00:00Z

[bandit]

@triva79 

How about...

| timechart span=1h limit=50 useother=false dc(userName) as count by userName

or maybe...

| eval session=userName+":"+sessionKey
| timechart span=1h limit=50 useother=false dc(session) as count by session

[ITWhisperer · Accepted solution]

The session is only present 3 times in the hour, the fourth one at 13:00 is in the next hour

Anyway, assuming you still want to count different sessions for the same user separately, you can do the stats twice

| bin _time span=1h
| stats count by _time, userName, sessionKey
| stats count by _time, userName

Depending on what count you actually want, you could also do this

| bin _time span=1h
| stats count by _time, userName, sessionKey
| stats count by _time

[triva79]

thanks so much 🙂 only my 2nd day using Splunk

[gcusello]

Hi @triva79 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[gcusello]

Hi @triva79,

you could use timechart or dedup:

<your_search>
| timechart span=1h count BY userName

Ciao.

Giuseppe