Activity Feed
- Posted How Do I Get A Unique User IP Logged For EVERY EVENT, Using MVJoin? on Splunk Search. 04-23-2019 03:59 PM
- Tagged How Do I Get A Unique User IP Logged For EVERY EVENT, Using MVJoin? on Splunk Search. 04-23-2019 03:59 PM
- Tagged How Do I Get A Unique User IP Logged For EVERY EVENT, Using MVJoin? on Splunk Search. 04-23-2019 03:59 PM
Topics I've Started
Subject | Karma | Author | Latest Post |
---|---|---|---|
0 |
04-23-2019
03:59 PM
Acceptance Criteria:
1) distinct count of user agents, and referrer url grouped by session id
2) distinct count of user ips and referrer url grouped by session id
However, the query (which I've included below) does not seem to do quite what I am trying to accomplish. According to the documentation, there is no way that the userIP field should ever be blank, yet I see numerous null values being returned.
Any ideas? Thanks in advance
| stats dc(playerUserAgent) as "Count of Unique User Agents", values(playerUserAgent) as useragents by sessionID | eval useragents = mvjoin(useragents, "|")
| join sessionID type=left [|stats dc(userIP) as "Count of Unique User IPs", values(userIP) as userIP by sessionID | eval userIP = mvjoin(userIP, "|")]
I've excluded the index and metrics I am querying for security purposes.
... View more
- Tags:
- mvjoin
- unique-fields