Implementing Splunk 7, Third Edition - Third Edition

Calculating the aggregate of transaction statistics

Using the values added by transaction, we can, somewhat naively, answer the questions of how long users spend on a site and how many pages they view per session.

Let's create sessions based on the uid field for all events. Using stats, we will then calculate the average duration value and the average eventcount value, and while we're at it, we will determine the distinct number of users and session IDs:

sourcetype="impl_splunk_web" 
| transaction maxpause=5m uid 
| stats avg(duration) avg(eventcount) dc(user) dc(uid) 

This will give us a table as shown in the following screenshot:

Transactions ...