Splunk Operational Intelligence Cookbook - Third Edition

How to do it...

Follow the steps in this recipe to create a state table of sessions:

1. Log in to your Splunk server.
2. Select the Operational Intelligence application.
3. In the search bar, enter the search and select to run it over Last 15 minutes:

index=main sourcetype="access_combined" | eval  firsttime=_time | eval lasttime=_time |  stats  earliest(firsttime) as firsttime, latest(lasttime) as lasttime  by JSESSIONID | outputlookup createinapp=true  session_state.csv

4. You should see a tabulated list by session ID, listing the firsttime and lasttime columns. Splunk will also have created a lookup named sessions.csv as a result of the search. The following is a screenshot of the tabulated list:
5. Next, amend the query slightly as follows and rerun ...