cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

User session events and actions by session id

TripleP
Newcomer

I'm trying to get the events/actions for a specific session.  

I have tried this query:

SELECT userevent.* FROM usersession WHERE ((useraction.application='site.com' OR userevent.application='site.com' OR usererror.application='site.com')) AND userId IS "User Name" AND usersession.userSessionId IS "session-id"
 
I get this back:
{
    "extrapolationLevel"1,
    "columnNames": [
        "userevent.application",
        "userevent.domain",
        "userevent.internalApplicationId",
        "userevent.name",
        "userevent.page",
        "userevent.pageGroup",
        "userevent.pageReferrer",
        "userevent.pageReferrerGroup",
        "userevent.startTime",
        "userevent.type"
    ],
    "values": []
}
 
But when I look at the same session in the dynatrace website I see a bunch of records.  I'm not sure how to craft the query to get the event/action detail I see on the dynatrace site when I query user sessions.

I am trying to provide data to a 3rd party that had a data breach so I'm just trying to gather as much information as possible to help them out.
3 REPLIES 3

Fin_Ubels
Dynatrace Advisor
Dynatrace Advisor

Hey TripleP

Having a look at the query there is no need for this ((useraction.application='site.com' OR userevent.application='site.com' OR usererror.application='site.com')) AND userId IS "User Name" AND as later on in the query you are specifying a session ID which doesn't need an application or user ID to narrow down a query. So if you already know the ID of the session then all you need to do is:

 

Fin_Ubels_2-1649890294035.png

SELECT userevent.* FROM usersession WHERE usersession.userSessionId IS "sessionID"

This returns the events from a session with ID "sessionID".

That works fine in the site, but when I make the API call using Postman it doesn't return anything.


Postman:

GET: https://XXXXX.live.dynatrace.com/api/v1/userSessionQueryLanguage/table?query=SELECT%20userevent.%2A%...

Response:

{
    "extrapolationLevel"1,
    "columnNames": [
        "userevent.application",
        "userevent.domain",
        "userevent.internalApplicationId",
        "userevent.name",
        "userevent.page",
        "userevent.pageGroup",
        "userevent.pageReferrer",
        "userevent.pageReferrerGroup",
        "userevent.startTime",
        "userevent.type"
    ],
    "values": []
}

Dynatrace Site:

TripleP_0-1649951899488.png

 

Another thing I noticed is that the Dynatrace site has an IP address that doesn't match anything in my webserver logs.  Any idea why the don't match?

Thanks for the help

Fin_Ubels
Dynatrace Advisor
Dynatrace Advisor

Hey TripleP

The only thing I can think of as to why it wouldn't work is that you haven't specified a timeframe to search within and if you don't specify a timeframe then it defaults to the last 2 hours. As you can see in the following image I specified a starting time as a query parameter. 

Fin_Ubels_0-1650323413782.png


As for the IP addresses not matching check the settings page for your application as by default I believe they are set to be masked to comply with regulations.

Fin_Ubels_1-1650323553822.png