Splunk Search

How to return a field that isn't part of the stats count?

markwymer
Path Finder

Hi,

I'm trying to get a table of all the Session_ID values when the count of Logon_IDs is more than 2, but since the stats count is based on the number of Logon_IDs, the Session_ID field is no longer available for me to table.

For example:

Data=
Logon_IDs       Session_ID
Jones           sess_1
Smith           sess_2
Brown           sess_3
Smith           sess_4

My first attempt was stats count BY Logon_IDs" | where count > 1 | table Session_ID, but this removes the Session_ID field.

What SPL should I be using to get the result:

Session_ID
sess_2
sess_4

Many thanks,
Mark.

0 Karma

sundareshr
Legend

Try this

.... | stats values(loginid) as lid count by sessionid | where mvcount(lid)>1
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...