Splunk Search

Transactions based on distinct values of extracted field

mjuopperi_elisa
New Member

Hi,

I'm trying to create transactions from events like this:

Session opened: [some id]

Session closed: [some id]

For a single id I can just use a search like this:

some_id | transaction startswith="Session closed" endswith="Session opened" maxpause=30m
to find sessions that had a break of at most 30 minutes.

The session_id I'm searching with is an extracted field. How would I go about finding the count of these transactions (closed -> opened) per session_id?

This is what I would like to get out:

session           connection_breaks
-----------------------------------
session1          1
session2          5
session3          2
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

some_id | transaction session_id startswith="Session closed" endswith="Session opened" maxpause=30m 
| stats count as connection_breaks by session_id
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...