Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Grouping by two fields, want to get distinct count of values in second field

$
0
0
Hi, I wrote the following Splunk query which returns a list of distinct USER_AGENTs for each SESSION_ID: index=abc | rex field=_raw "-S:(?\w+)-.+User agent: '(?.+)', Referrer" | stats count by SESSION_ID, USER_AGENT I would now like to modify this query to return a list of SESSION_IDs that have more than one unique value for USER_AGENT, and the count of the unique values. Thanks! Jonathan

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>