My dataset is in a rather strange format. For a given 'event', I have numerous splunk entries all linked by a 'session_id'. Within those sessions, there exist 2 fields I care about: name, request ...
See more...
My dataset is in a rather strange format. For a given 'event', I have numerous splunk entries all linked by a 'session_id'. Within those sessions, there exist 2 fields I care about: name, request But these all exist independently on one of the numerous entries for a given session_id. For example, we could have 5 events for one session: {session_id:15, time: 1600, offset:1} {session_id:15, time: 1605, name:bob} {session_id:15, time: 1607, type: sandwich} {session_id:15, time: 1608, type: drink} {session_id:15, time: 1610, offset: 2} The first question is, for a given name - bob here - how do I do a search that would do the following: Find all events with bob, count how many sandwich orders there were, count how many drink orders there were. My attempt was to enumerate all session_ids for a given name, so for bob there could be session_ids of 5,7,10,15 Then for each session_id, do a subsearch specifying the session_id, and attempt to count the number of type:sandwich and type:drink fields there were. I couldn't work out how to get this to return to the main query in a good format.