Splunk Search

How to use the stats command to get the sums of 3 fields and the count of sessions IDs by user in one table?

lmaclean
Path Finder

So far I have the stats for calculating Total, Upload & Download Bandwidths by user, but then I also want to get a count of session IDs (sessionid) on the same table.:

... | stats sum(bandwidth_total) as "Bandwidth", sum(bandwidth_upload) as Upload, sum(bandwidth_download) as Download by user | sort -Bandwidth | rename Bandwidth as "Total Bandwidth"

I have tried adding a count(sessionid) to the mix, but it doesn't work and returns a "0" for that field and if I try it by itself stats count by sessionid, I get the sessionid which is just a high number then a count of "1".

So I am trying to work out search that can cover a week/month period to calculate users' bandwidth over that period, the number of sessions they had as well, and have all of this on one table if possible.

0 Karma
1 Solution

woodcock
Esteemed Legend

This should definitely work:

... | stats sum(bandwidth_total) as "Bandwidth", sum(bandwidth_upload) as Upload, sum(bandwidth_download) as Download dc(sessionid) AS SessionIDs by user | sort -Bandwidth | rename Bandwidth as "Total Bandwidth"

If it is not working then the problem is probably with the extraction of the sessionid field/value or that the logs that have sessionid do not also have user (maybe user is spelled or capitalized differently).

View solution in original post

woodcock
Esteemed Legend

This should definitely work:

... | stats sum(bandwidth_total) as "Bandwidth", sum(bandwidth_upload) as Upload, sum(bandwidth_download) as Download dc(sessionid) AS SessionIDs by user | sort -Bandwidth | rename Bandwidth as "Total Bandwidth"

If it is not working then the problem is probably with the extraction of the sessionid field/value or that the logs that have sessionid do not also have user (maybe user is spelled or capitalized differently).

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...