topic Re: captures users sum by url by date in Splunk Search

captures users sum by url by date

sdagostino — Fri, 28 May 2010 01:03:59 GMT

I need to add something to the following search string (or rewrite it) that captures the following;

User
Destination URL
Number of times the user accessed the Destination URL per day
total number of hits to the Destination URL.

This search string

host="192.168.105.25" Prism http://DCSPRSAPPTS01.chpnet.org:80//Citrix/MetaFrame action="POST"| stats count by user, dest_url

Generates the following results

user     dest_url                                                               Count
phtwe    http://DCSPRSAPPTS01.chpnet.org:80//Citrix/MetaFrame/auth/login.aspx   99 
nkhan    http://DCSPRSAPPTS01.chpnet.org:80//Citrix/MetaFrame/auth/login.aspx   83

Re: captures users sum by url by date

Simeon — Fri, 28 May 2010 01:27:50 GMT

Can you clarify what you want to get the sum of?

Re: captures users sum by url by date

Lowell — Fri, 28 May 2010 01:51:52 GMT

By "string", do you mean "search string"? Can you provide a sample event or two. I assume your are looking at some kind of http access log? Is this correct? (Please edit your question and provide some additional details.)

Re: captures users sum by url by date

Simeon — Sat, 29 May 2010 00:27:19 GMT

I'm still confused. I think you should supply some sample events and clarify exactly what you need to do functionally.

Re: captures users sum by url by date

Lowell — Fri, 04 Jun 2010 02:01:39 GMT

Still not sure what your are really asking here, but perhaps the following question/answer would be helpful to you. You both seem to be looking at Citrix/MetaFrame POST events:

search that captures sum of users by url

Re: captures users sum by url by date

sideview — Mon, 07 Jun 2010 02:03:39 GMT

Note: I just improved the formatting of the question so its more readable now.

Re: captures users sum by url by date

gkanapathy — Mon, 07 Jun 2010 05:06:42 GMT

Do you just want the equivalent of:

 ... | bucket _time span=1d | stats count by _time,user,dest_url

Seems to me that's it. If you want the total for each URL, you can get it by adding:

 ... | eventstats sum(count) as total_count by _time,dest_url

or there is a trick you can do by creating a multivalued field:

... | eval user=user+";"+"*" | eval user=split(user,";") | bucket _time span=1d | stats count by _time,user,dest_url

which will put the total count as the * user. You can use any value besides * if it doesn't conflict with a real user name.