Log stream looks like this:
session=1234567 client=acme start
sltsession=abcdef continuing page=1
sltsession=abcdef continuing page=2
sltsession=abcdef continuing page=2
sltsession=abcdef continuing page=1
The sltsession value is created using eval and md5() with the session and client values. What I want is a table of each page log by the client value, but I'm failing to see how to map the eval'd sltsession field with the client field on all subsequent logs past the 1st. I want a table similar to this:
acme start
acme page 1
acme page 2
acme page 2
acme page 1
Thanks,
Jon
Could you do this
yoursearchhere
| eval sltsession = if(notnull(sltsession), md5(session + client), sltsession)
| transaction sltsession
| stats values(page) as Pages by client session
list() is not supposed to dedup...
You might also see what
| table client session page
would do instead of the stats command
It's close, but the list() and values() stats functions de-dup the values. 😕