Splunk Dev

Translating a defined tracking session using SPL

dwong2
New Member

How would I do this in SPL?

I want to calculate a tracking session:
Find an ENTER event in the log.
Search forward in the log data for events after this event with the same device ID and same account ID. Sort them by date (ascending).

Walk through the log events in order, adding them to the session. If any of the following occurs, we stop searching:

If the next is more than "session timeout" (default 5 minutes) after the previous event in the session, consider the session terminated.

If an EXIT or TIMEOUT event occurs, consider the session terminated.

Find the last non-timeout event.
Session duration calculation is based on the time difference between the first event and the last non-timeout event.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...