https://community.splunk.com/t5/Splunk-Search/Help-with-Search-String-for-Ironport-to-aggregate-destination/m-p/149426#M185465 <P>For your original question, this should work</P> <PRE><CODE>search index=summary user_id=** | search x_webcat_code_full!=Advertisements | stats sum(duration) as browsing_time by dest_domain _time user_id x_webcat_code_full duration | fieldformat browsing_time = tostring(browsing_time,"duration") | table _time, dest_domain, x_webcat_code_full, user_id, browsing_time | stats sum(browing_time) as total_browing_time count by dest_domain_time </CODE></PRE> <P>Can you give more details about what you need as part of 2nd question?</P> Mon, 05 May 2014 19:33:09 GMT somesoni2 2014-05-05T19:33:09Z https://community.splunk.com/t5/Splunk-Search/Help-with-Search-String-for-Ironport-to-aggregate-destination/m-p/149424#M185463 <P>I am using this Search String to return results for specific user accounts:</P> <P>search index=summary user_id=****** | search x_webcat_code_full!=Advertisements | stats sum(duration) as browsing_time by dest_domain _time user_id x_webcat_code_full duration | fieldformat browsing_time = tostring(browsing_time,"duration") | table _time, dest_domain, x_webcat_code_full, user_id, browsing_time</P> <P>I am looking to aggregate the results by destination domain, and show an aggregate number for each domain by browsing_time and show a count. So instead of showing:</P> <P>google.com 2mins<BR /> google.com 1min<BR /> google.com 5min</P> <P>It would show only<BR /> google.com 8mins Count 3</P> <P>Thanks for any help...</P> Mon, 28 Sep 2020 16:30:59 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-Search-String-for-Ironport-to-aggregate-destination/m-p/149424#M185463 sinescorey 2020-09-28T16:30:59Z https://community.splunk.com/t5/Splunk-Search/Help-with-Search-String-for-Ironport-to-aggregate-destination/m-p/149425#M185464 <P>"search sourcetype=wsa_accesslogs" vs search index=summary gives you a break down of the actual site visit times. Anyone else have an answer on how to aggregate the sites and times visited?</P> Mon, 05 May 2014 17:44:39 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-Search-String-for-Ironport-to-aggregate-destination/m-p/149425#M185464 sinescorey 2014-05-05T17:44:39Z https://community.splunk.com/t5/Splunk-Search/Help-with-Search-String-for-Ironport-to-aggregate-destination/m-p/149426#M185465 <P>For your original question, this should work</P> <PRE><CODE>search index=summary user_id=** | search x_webcat_code_full!=Advertisements | stats sum(duration) as browsing_time by dest_domain _time user_id x_webcat_code_full duration | fieldformat browsing_time = tostring(browsing_time,"duration") | table _time, dest_domain, x_webcat_code_full, user_id, browsing_time | stats sum(browing_time) as total_browing_time count by dest_domain_time </CODE></PRE> <P>Can you give more details about what you need as part of 2nd question?</P> Mon, 05 May 2014 19:33:09 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-Search-String-for-Ironport-to-aggregate-destination/m-p/149426#M185465 somesoni2 2014-05-05T19:33:09Z https://community.splunk.com/t5/Splunk-Search/Help-with-Search-String-for-Ironport-to-aggregate-destination/m-p/149427#M185466 <P>Hey your right,</P> <P>search sourcetype=wsa_accesslogs user_id=* | search x_webcat_code_full!=Advertisements | transaction user_id maxpause=5m | search dest_domain=*| stats sum(duration) as browsing_time by dest_domain | fieldformat browsing_time = tostring(browsing_time,"duration")</P> <P>This gives me what I am looking for thanks!</P> Mon, 28 Sep 2020 16:32:15 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-Search-String-for-Ironport-to-aggregate-destination/m-p/149427#M185466 sinescorey 2020-09-28T16:32:15Z