Implementing Splunk 7, Third Edition - Third Edition

Combining subsearches with transaction

Let's put what we learned about subsearches together with transactions. Let's imagine that q=1 represents a particular entry point into our site, perhaps a link from an advertisement. We can use subsearch to find users that clicked on the advertisement, then use transaction to determine how long these users stayed on our site.

To do this, first we need to locate the sessions initiated from this link. The search can be as simple as:

sourcetype="impl_splunk_web" q=1 

This will return events like the following:

In our fictitious logs, the field uid represents a session ID. Let's use stats to return one row ...