User session events and actions by session ID

[TripleP]

I'm trying to get the events/actions for a specific session.  

I have tried this query:

SELECT userevent.* FROM usersession WHERE ((useraction.application='site.com' OR userevent.application='site.com' OR usererror.application='site.com')) AND userId IS "User Name" AND usersession.userSessionId IS "session-id"

I get this back:

{

    "extrapolationLevel": 1,

    "columnNames": [

        "userevent.application",

        "userevent.domain",

        "userevent.internalApplicationId",

        "userevent.name",

        "userevent.page",

        "userevent.pageGroup",

        "userevent.pageReferrer",

        "userevent.pageReferrerGroup",

        "userevent.startTime",

        "userevent.type"

    ],

    "values": []

}

But when I look at the same session in the dynatrace website I see a bunch of records.  I'm not sure how to craft the query to get the event/action detail I see on the dynatrace site when I query user sessions.

I am trying to provide data to a 3rd party that had a data breach so I'm just trying to gather as much information as possible to help them out.

[Fin_Ubels]

Hey TripleP

Having a look at the query there is no need for this ((useraction.application='site.com' OR userevent.application='site.com' OR usererror.application='site.com')) AND userId IS "User Name" AND as later on in the query you are specifying a session ID which doesn't need an application or user ID to narrow down a query. So if you already know the ID of the session then all you need to do is:

SELECT userevent.* FROM usersession WHERE usersession.userSessionId IS "sessionID"

This returns the events from a session with ID "sessionID".

[TripleP]

That works fine in the site, but when I make the API call using Postman it doesn't return anything.

Postman:

GET: https://XXXXX.live.dynatrace.com/api/v1/userSessionQueryLanguage/table?query=SELECT%20userevent.%2A%20FROM%20usersession%20WHERE%20usersession.userSessionId%20IS%20%22QKSKGBOGPCTKCCQANCIFUAKIWKMSUAOC-0%22 

Response:

{

    "extrapolationLevel": 1,

    "columnNames": [

        "userevent.application",

        "userevent.domain",

        "userevent.internalApplicationId",

        "userevent.name",

        "userevent.page",

        "userevent.pageGroup",

        "userevent.pageReferrer",

        "userevent.pageReferrerGroup",

        "userevent.startTime",

        "userevent.type"

    ],

    "values": []

}

Dynatrace Site:

Another thing I noticed is that the Dynatrace site has an IP address that doesn't match anything in my webserver logs.  Any idea why the don't match?

Thanks for the help

[Fin_Ubels · Accepted solution]

Hey TripleP

The only thing I can think of as to why it wouldn't work is that you haven't specified a timeframe to search within and if you don't specify a timeframe then it defaults to the last 2 hours. As you can see in the following image I specified a starting time as a query parameter. 

As for the IP addresses not matching check the settings page for your application as by default I believe they are set to be masked to comply with regulations.