Splunk Search

How do you list the pages visited for a particular session id?

qodeninja
Explorer

I'd like to get a list of sessions each with their page views and session durations like this:

Session12324 | Session Duration | /path/page/1 /path/page/2

Tags (2)
1 Solution

sdaniels
Splunk Employee
Splunk Employee

You should look at the transaction command. It will create a field for you call duration as well so you can see length of a particular session. Then create a table with specific fields you'd like to see.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/transaction

<your search> | transaction sessionID

View solution in original post

qodeninja
Explorer

sure, its log4j, looks like JSON, has RequestURI and SessionID as fields

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

I think based on the answers below that you should get what you need right?

0 Karma

kristian_kolb
Ultra Champion

please provide some more info about the log file format you have, otherwise it'll be harder to be of help.

0 Karma

sdaniels
Splunk Employee
Splunk Employee

You should look at the transaction command. It will create a field for you call duration as well so you can see length of a particular session. Then create a table with specific fields you'd like to see.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/transaction

<your search> | transaction sessionID

qodeninja
Explorer

yep transaction is what I needed, thank you!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...