Splunk Search

How to return a field that isn't part of the stats count?

markwymer
Path Finder

Hi,

I'm trying to get a table of all the Session_ID values when the count of Logon_IDs is more than 2, but since the stats count is based on the number of Logon_IDs, the Session_ID field is no longer available for me to table.

For example:

Data=
Logon_IDs       Session_ID
Jones           sess_1
Smith           sess_2
Brown           sess_3
Smith           sess_4

My first attempt was stats count BY Logon_IDs" | where count > 1 | table Session_ID, but this removes the Session_ID field.

What SPL should I be using to get the result:

Session_ID
sess_2
sess_4

Many thanks,
Mark.

0 Karma

sundareshr
Legend

Try this

.... | stats values(loginid) as lid count by sessionid | where mvcount(lid)>1
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...