cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

User session events and actions by session id

TripleP
Newcomer

I'm trying to get the events/actions for a specific session.  

I have tried this query:

SELECT userevent.* FROM usersession WHERE ((useraction.application='site.com' OR userevent.application='site.com' OR usererror.application='site.com')) AND userId IS "User Name" AND usersession.userSessionId IS "session-id"
 
I get this back:
{
    "extrapolationLevel"1,
    "columnNames": [
        "userevent.application",
        "userevent.domain",
        "userevent.internalApplicationId",
        "userevent.name",
        "userevent.page",
        "userevent.pageGroup",
        "userevent.pageReferrer",
        "userevent.pageReferrerGroup",
        "userevent.startTime",
        "userevent.type"
    ],
    "values": []
}
 
But when I look at the same session in the dynatrace website I see a bunch of records.  I'm not sure how to craft the query to get the event/action detail I see on the dynatrace site when I query user sessions.

I am trying to provide data to a 3rd party that had a data breach so I'm just trying to gather as much information as possible to help them out.
3 REPLIES 3

Fin_Ubels
Dynatrace Helper
Dynatrace Helper

Hey TripleP

Having a look at the query there is no need for this ((useraction.application='site.com' OR userevent.application='site.com' OR usererror.application='site.com')) AND userId IS "User Name" AND as later on in the query you are specifying a session ID which doesn't need an application or user ID to narrow down a query. So if you already know the ID of the session then all you need to do is:

 

Fin_Ubels_2-1649890294035.png

SELECT userevent.* FROM usersession WHERE usersession.userSessionId IS "sessionID"

This returns the events from a session with ID "sessionID".

That works fine in the site, but when I make the API call using Postman it doesn't return anything.


Postman:

GET: https://XXXXX.live.dynatrace.com/api/v1/userSessionQueryLanguage/table?query=SELECT%20userevent.%2A%...

Response:

{
    "extrapolationLevel"1,
    "columnNames": [
        "userevent.application",
        "userevent.domain",
        "userevent.internalApplicationId",
        "userevent.name",
        "userevent.page",
        "userevent.pageGroup",
        "userevent.pageReferrer",
        "userevent.pageReferrerGroup",
        "userevent.startTime",
        "userevent.type"
    ],
    "values": []
}

Dynatrace Site:

TripleP_0-1649951899488.png

 

Another thing I noticed is that the Dynatrace site has an IP address that doesn't match anything in my webserver logs.  Any idea why the don't match?

Thanks for the help

Hey TripleP

The only thing I can think of as to why it wouldn't work is that you haven't specified a timeframe to search within and if you don't specify a timeframe then it defaults to the last 2 hours. As you can see in the following image I specified a starting time as a query parameter. 

Fin_Ubels_0-1650323413782.png


As for the IP addresses not matching check the settings page for your application as by default I believe they are set to be masked to comply with regulations.

Fin_Ubels_1-1650323553822.png