https://community.splunk.com/t5/Splunk-Search/stats-for-user-internet-traffic/m-p/73412#M18388 <P>If I understand you correctly, this should do what you want</P> <PRE><CODE>your_search | stats c AS Requests mode(URL) AS Most_Popular by User, Category | sort - Requests | dedup 2 Category | sort Category </CODE></PRE> <P>Hope this helps,</P> <P>Kristian</P> Fri, 17 Feb 2012 14:09:07 GMT kristian_kolb 2012-02-17T14:09:07Z https://community.splunk.com/t5/Splunk-Search/stats-for-user-internet-traffic/m-p/73410#M18386 <P>I am trying to write a query that filters our users' network traffic. I would like the query to return information on the top 2 users in each type of web site category and when available provide the most frequently accessed URL in that category. Sometimes the URL value is NULL.</P> <P>For example, results could be:<BR /> <PRE><BR /> Count Category User URL<BR /> 27 news bob msn.com<BR /> 15 news sally news.google.com<BR /> 80 games joe gamespot.com<BR /> 33 games alice giantbomb.com<BR /> 150 social-net jill facebook.com<BR /> 12 social-net bob twitter.com<BR /> 60 unknown joe<BR /> </PRE></P> <P>So far I have come up with this, but it does not return the top two and I know the URL value returned does not necessarily correspond with the user.</P> <PRE><CODE>search... | stats mode(User) mode(URL) count by Category </CODE></PRE> <P>Thanks for any help.</P> <P>Here is some sample raw data ("web-browsing" is the Category and the URL exists in the second sample only):</P> <PRE><CODE>Feb 16 16:14:54 10.10.10.21 Feb 16 16:14:54 1,2012/02/16 16:14:54,000000000,TRAFFIC,end,1,2012/02/16 16:14:53,10.10.10.3,74.125.45.94,216.221.226.40,74.125.45.94,PermitAlloutgoingwithScanning,bob,,web-browsing,vsys1,Trust,Untrust,ethernet1/2,ethernet1/1,syslog,2012/02/16 16:14:53,99723,1,55628,80,5238,80,0x400000,tcp,allow,2157,2157,2157,10,2012/02/16 16:12:27,116,allow-list,0,0,0x0,10.0.0.0-10.255.255.255,United States,0 Feb 16 16:14:54 10.10.10.21 Feb 16 16:14:53 1,2012/02/16 16:14:53,000000000,THREAT,url,1,2012/02/16 16:14:52,10.10.10.4,66.161.82.146,216.221.226.40,66.161.82.146,PermitAlloutgoingwithScanning,sally,,web-browsing,vsys1,Trust,Untrust,ethernet1/2,ethernet1/1,syslog,2012/02/16 16:14:53,52281,1,51046,80,14287,80,0x408000,tcp,alert,"www.cdgnow.com/resources/images/theme/content/secondary-nav-li-a-bg.png",(9999),business-and-economy,informational,client-to-server,0,0x0,10.0.0.0-10.255.255.255,United States,0,text/html </CODE></PRE> Thu, 16 Feb 2012 22:40:34 GMT https://community.splunk.com/t5/Splunk-Search/stats-for-user-internet-traffic/m-p/73410#M18386 Justin 2012-02-16T22:40:34Z https://community.splunk.com/t5/Splunk-Search/stats-for-user-internet-traffic/m-p/73411#M18387 <P>Can you post some of the raw data that the above results will be drawn from?</P> Thu, 16 Feb 2012 23:54:00 GMT https://community.splunk.com/t5/Splunk-Search/stats-for-user-internet-traffic/m-p/73411#M18387 sbrant_tt 2012-02-16T23:54:00Z https://community.splunk.com/t5/Splunk-Search/stats-for-user-internet-traffic/m-p/73412#M18388 <P>If I understand you correctly, this should do what you want</P> <PRE><CODE>your_search | stats c AS Requests mode(URL) AS Most_Popular by User, Category | sort - Requests | dedup 2 Category | sort Category </CODE></PRE> <P>Hope this helps,</P> <P>Kristian</P> Fri, 17 Feb 2012 14:09:07 GMT https://community.splunk.com/t5/Splunk-Search/stats-for-user-internet-traffic/m-p/73412#M18388 kristian_kolb 2012-02-17T14:09:07Z https://community.splunk.com/t5/Splunk-Search/stats-for-user-internet-traffic/m-p/73413#M18389 <P>Thanks Kristian, that did the trick.</P> Fri, 17 Feb 2012 17:42:50 GMT https://community.splunk.com/t5/Splunk-Search/stats-for-user-internet-traffic/m-p/73413#M18389 Justin 2012-02-17T17:42:50Z