topic Re: count query - how to combine with a count on uniqu URLs in Splunk Search https://community.splunk.com/t5/Splunk-Search/count-query-how-to-combine-with-a-count-on-uniqu-URLs/m-p/52689#M12820 <P>assuming your URL's are already being extracted you should be able to do it the following way.</P> <PRE><CODE>sourcetype=hwa_other source=/var/tomcat/servers/HAP01/logs/tomcat_access*.log "dealswidget" OR "hotelquerywidget" | rex "(?&lt;myword&gt;dealswidget|hotelquerywidget)" | stats dc(yoururlfield) as uniqueurls by myword </CODE></PRE> Wed, 03 Aug 2011 12:41:33 GMT RicoSuave 2011-08-03T12:41:33Z count query - how to combine with a count on uniqu URLs https://community.splunk.com/t5/Splunk-Search/count-query-how-to-combine-with-a-count-on-uniqu-URLs/m-p/52688#M12819 <P>Hi. I have a query that returns a number count based on the occurence of 2 keywords:</P> <PRE><CODE>sourcetype=hwa_other source=/var/tomcat/servers/HAP01/logs/tomcat_access*.log "dealswidget" OR "hotelquerywidget" | rex "(?&lt;myword&gt;dealswidget|hotelquerywidget)" | stats count by myword </CODE></PRE> <P>The results are 2 counts:</P> <PRE><CODE>1 dealswidget 9847 2 hotelquerywidget 88826 </CODE></PRE> <P>After this i'd like a count on unique URLs. The log lines look like:<BR /> (A typical URL is in the log line below and always in that position)</P> <PRE><CODE>10.186.198.6 - - [29/Jul/2011:00:03:08 -0500] "GET /js/lib/jquery-1.5.js HTTP/1.0" 200 211978 "http://partners.hotels.com/hotelquerywidget/1/1/HCOM_ES-es_ES/hotelquerywidget.html" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30" "5DC1789408E34ECF1A8F25E521617E9D.ut03hap01" 10.186.198.6 - - [29/Jul/2011:00:09:04 -0500] "GET /styles/widget/hcom.external.common.css HTTP/1.1" 200 4255 "http://partners.hotels.com/dealswidget/1/2/1633826/HCOM_NO-no_NO/widget.html" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30" "3EDEC4AAE25F8C92260C2132409F54BC.ut03hap01" </CODE></PRE> <P>Any help would be appreciated. </P> Wed, 03 Aug 2011 09:53:40 GMT https://community.splunk.com/t5/Splunk-Search/count-query-how-to-combine-with-a-count-on-uniqu-URLs/m-p/52688#M12819 nishil 2011-08-03T09:53:40Z Re: count query - how to combine with a count on uniqu URLs https://community.splunk.com/t5/Splunk-Search/count-query-how-to-combine-with-a-count-on-uniqu-URLs/m-p/52689#M12820 <P>assuming your URL's are already being extracted you should be able to do it the following way.</P> <PRE><CODE>sourcetype=hwa_other source=/var/tomcat/servers/HAP01/logs/tomcat_access*.log "dealswidget" OR "hotelquerywidget" | rex "(?&lt;myword&gt;dealswidget|hotelquerywidget)" | stats dc(yoururlfield) as uniqueurls by myword </CODE></PRE> Wed, 03 Aug 2011 12:41:33 GMT https://community.splunk.com/t5/Splunk-Search/count-query-how-to-combine-with-a-count-on-uniqu-URLs/m-p/52689#M12820 RicoSuave 2011-08-03T12:41:33Z