https://community.splunk.com/t5/Getting-Data-In/Find-files-that-are-not-being-accessed/m-p/103943#M21873 <P>The scenario:<BR /> I have a scripted input that gives me a list of files in a directory. On a regular basis I want to run a search that will see how many times each of those has been served by the webserver. I also want to include in the report any files that have not been hit in the report.</P> <P>Assume the subsearch for the list of files is just:</P> <PRE><CODE>[search sourcetype=dirlist | fields filename ] </CODE></PRE> <P>And that it's searching against normal apache access logs.</P> Thu, 19 Jul 2012 19:58:05 GMT christopher_hod 2012-07-19T19:58:05Z https://community.splunk.com/t5/Getting-Data-In/Find-files-that-are-not-being-accessed/m-p/103943#M21873 <P>The scenario:<BR /> I have a scripted input that gives me a list of files in a directory. On a regular basis I want to run a search that will see how many times each of those has been served by the webserver. I also want to include in the report any files that have not been hit in the report.</P> <P>Assume the subsearch for the list of files is just:</P> <PRE><CODE>[search sourcetype=dirlist | fields filename ] </CODE></PRE> <P>And that it's searching against normal apache access logs.</P> Thu, 19 Jul 2012 19:58:05 GMT https://community.splunk.com/t5/Getting-Data-In/Find-files-that-are-not-being-accessed/m-p/103943#M21873 christopher_hod 2012-07-19T19:58:05Z https://community.splunk.com/t5/Getting-Data-In/Find-files-that-are-not-being-accessed/m-p/103944#M21874 <P>Maybe something like:</P> <PRE><CODE>sourcetype=access_combined [ search sourcetype=dirlist | fields filename ] | stats count as hitcount by filename | append [ search sourcetype=dirlist | fields filename | eval hitcount=0 ] | stats max(hitcount) by filename </CODE></PRE> Thu, 19 Jul 2012 20:01:27 GMT https://community.splunk.com/t5/Getting-Data-In/Find-files-that-are-not-being-accessed/m-p/103944#M21874 dwaddle 2012-07-19T20:01:27Z