Basic search help

amagson — Tue, 14 Dec 2021 11:10:40 GMT

Hello all,

I need a hand with a basic Splunk search. I appreciate this is Splunk 101 basics, but with other commitments, I am struggling to remember all commands.

What I need is to edit the following search, (or someone kind enough to completely improve the search), that rather the showing the same day next to each URL in the field "day", it just shows all URLs next to one single entry of the day. hopefully, that makes sense?

index=netproxy user=(user) (url=https://www* OR url=http://www.)
| stats count by day, url

day url count

Mon, 13 Dec 2021 https://www.bizographics.com/   1
Mon, 13 Dec 2021 https://www.bleacherbreaker.com/   2788
Mon, 13 Dec 2021 https://www.google-analytics.com/ 3
Mon, 13 Dec 2021 https://www.google.co.uk/   5
Mon, 13 Dec 2021 https://www.googletagmanager.com/ 10
Mon, 13 Dec 2021 https://www.googletagservices.com/ 6
Sat, 11 Dec 2021 https://www.capitalfm.com/ 23
Sat, 11 Dec 2021 https://www.capitalxtra.com/ 26
Sat, 11 Dec 2021 https://www.globalplayer.com/ 8

Basically what I am after is a search that shows, -

day url times visited(count)
Mon, 13 Dec 2021   https://www.bizographics.com/   1
https://www.bleacherbreaker.com/   2788
https://www.google-analytics.com/   3
https://www.google.co.uk/ 5
https://www.googletagmanager.com/ 10
https://www.googletagservices.com/ 5

If anyone can improve on my basic search it would be greatly appreciated

Re: Basic search help

ITWhisperer — Tue, 14 Dec 2021 11:39:24 GMT

index=netproxy user=(user) (url=https://www* OR url=http://www.) | stats count by day, url | stats list(url) as url list(count) as count by day

Re: Basic search help

amagson — Tue, 14 Dec 2021 11:45:30 GMT

that works well thank you 🙂

topic Re: Basic search help in Splunk Search

Basic search help

Re: Basic search help

Re: Basic search help