topic Check what URLs are called in Splunk Enterprise

Check what URLs are called

cramery — Mon, 18 Mar 2019 09:29:15 GMT

New to Splunk, so a bit of a basic question

I need to have a list of all URLs that are called by the User on the PC Splunk is running on. It doesnt matter if all URLs or called by a specific application. How can I implement this to Splunk?

Re: Check what URLs are called

niketn — Mon, 18 Mar 2019 11:54:15 GMT

Do you mean URLs internal to Splunk or a client/server with Splunk Forwarder which is trying to access external URLs?

Re: Check what URLs are called

sduff_splunk — Mon, 18 Mar 2019 11:58:53 GMT

Are you referring to Splunk URLs? For example, https://localhost:8000/en-US/app/search/search and https://localhost:8000/en-US/app/search/search?q=search%20index%3D*&sid=1552910209.54&display.page.search.mode=verbose&dispatch.sample_ratio=1&workload_pool=&earliest=-24h%40h&latest=now

If so, you can run a query such as
index=_internal sourcetype=splunk_web_access | stats count by uri

Re: Check what URLs are called

cramery — Mon, 18 Mar 2019 18:26:00 GMT

Actually I'm just trying to get a list in Splunk when, which user called what URL ond any Website (like google.com in Google Chrome), same way as I can see all Applications called by the user

Re: Check what URLs are called

cramery — Mon, 18 Mar 2019 18:27:07 GMT

I'm trying to get a list in Splunk when, which user called what URL ond any Website (like google.com in Google Chrome), same way as I can see all Applications called by the user.

Re: Check what URLs are called

sduff_splunk — Tue, 19 Mar 2019 03:56:52 GMT

If you have data in an index such as weblogs, you would do a search such as
index=weblogs sourcetype=access_combined OR sourcetype=iis | eval full_path=uri_domain.uri_path| stats values(full_path) by user