topic Re: Table wont show on search in Reporting

Table wont show on search

jacksonchandler — Thu, 18 Jul 2024 04:14:42 GMT

Hi,

Im trying to collate URL domain names of users who visit websites over the course of 24 hours. It pulls the right data but it wont table and im not sure how to fix it. Im using URL Toolbox to parse the domain out.

index="##" eventtype=pan $user$ hoursago=24
| eval list="mozilla"
| `ut_parse_extended(url,list)`
| stats count by ut_domain_without_tld
| table ut_domain_without_tld count

Im fairly new to splunk so any help is appreciated.

Re: Table wont show on search

gcusello — Thu, 18 Jul 2024 05:43:03 GMT

Hi @jacksonchandler ,

let me understand:

if you run the search without the last row (the table command) does ir run and does you have results?

if yes, remove the last row, also because you don't need it.

if not, run the search without the last two rows and check if the field ut_domain_without_tld is present.

Could you share the content of the macro?

if you use <CTRL><SHIFT>E on the search with the macro, you can have the full search (without macro) displayed in a window.

Ciao.

Giuseppe

Re: Table wont show on search

jacksonchandler — Thu, 18 Jul 2024 05:57:25 GMT

Thanks Guiseppe. I solved it myself with your advice - data was there but wasnt showing as a table because my dashboard wasnt configured to do that - was to be shown as a list. Changed that and worked!

Re: Table wont show on search

gcusello — Thu, 18 Jul 2024 06:08:11 GMT

Hi @jacksonchandler ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉