We used this to produce a distribution of how long our sessions last. We print the median, average, and maximum session length based on the first and last occurrence of a given JSESSIONID. We also filter out those sessions less than ten seconds in length, to eliminate skew. If you need to view it differently, change the value accordingly.<\/p>\n
\r\nhost=cmhlpecomweb* sourcetype=access*\r\n | rex mode=sed field=_raw \"s\/\\t\/~\/g\"\r\n | eval tmp=split(_raw,\"~\")\r\n | eval jsessionid = mvindex(tmp,14)\r\n | transaction jsessionid\r\n | stats sum(duration) AS session_time by jsessionid\r\n | where session_time > 10\r\n | stats median(session_time),avg(session_time),max(session_time)\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"We used this to produce a distribution of how long our sessions last. We print the median, average, and maximum session length based on the first and last occurrence of a given JSESSIONID. We also filter out those sessions less…<\/p>\n