Combining subsearches with transaction

Let's put what we learned about subsearches together with transactions. Let's imagine that q=1 represents a particular entry point into our site, perhaps a link from an advertisement. We can use subsearch to find users that clicked on the advertisement, then use transaction to determine how long these users stayed on our site.

To do this, first we need to locate the sessions initiated from this link. The search can be as simple as:

sourcetype="impl_splunk_web" q=1 

This will return events like the following:

In our fictitious logs, the field uid represents a session ID. Let's use stats to return one row ...

Get Implementing Splunk 7 - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.