Splunk Search

Two searches combined including transaction

DanielFordWA
Contributor

The below gives me the correct number of hits per external user

sourcetype="iis-2" | extract auto=true | search CORE_employee="F*" | stats count(cs_uri_stem) AS Hits by cs_username date | fields date cs_username Hits

The second search below gives me the roughly correct number of visits per user, I need to refine it slightly.

sourcetype="iis-2" | extract auto=true | search CORE_employee="F*" | transaction cs_username maxspan=30m | stats count AS Visits by cs_username date | fields date cs_username Visits

How would I combine the two into one search that would result in a table

date, cs_username, Hits, Visits

0 Karma

wpreston
Motivator

I reread your question and updated my search to address request more accurately. One way would be the append command, with some eval and possibly stats usage as well. The key is making each search have the same columns. How about something like this:

sourcetype="iis-2" 
    | extract auto=true 
    | search CORE_employee="F*" 
    | eval Visits=0 
    | stats count(cs_uri_stem) AS "Hits", sum(Visits) as "Visits" by cs_username date 
    | fields date cs_username Hits Visits 
| append [search sourcetype="iis-2" 
    | extract auto=true 
    | search CORE_employee="F*" 
    | transaction cs_username maxspan=30m 
    | eval Hits=0 
    | stats count AS "Visits", sum(Hits) as "Hits" by cs_username date 
    | fields date cs_username Hits Visits ] 
| stats sum(Hits) as "Hits", sum(Visits) as "Visits" by date, cs_username 

Does this do what you need?

DanielFordWA
Contributor

Sorry for the late reply, this does seem to work for some months and not others, I'll investigate a bit and see what the issue is. Thanks for the response.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...