You are on page 1of 1

index=web (sourcetype=acc* OR sourcetype=van*) action=purchase status<400

| timechart span=1h sum(price) by sourcetype

index=web sourcetype=access_combined
| table clientip, action, productId, status

index=main sourcetype="access_combined_wcookie" status="200"

index=main sourcetype="access_combined_wcookie" status="200"


| dedup JSESSIONID
| table JSESSIONID
| rename JSESSIONID as UserSessions
| sort UserSessions

You might also like