topic Re: URLs by host in Splunk Search

URLs by host

waJesu — Thu, 10 Oct 2024 12:15:13 GMT

I need a query that lists URLs a particular host has reached out in a particular time e.g in the last 24 hours. Please help

Re: URLs by host

gcusello — Thu, 10 Oct 2024 12:34:54 GMT

Hi @waJesu ,

if host is the host sending the logs and url is a fied in your logs, youcould run something like this:

index=your_index sourcetype=your_sourcetype earliest=-24h latest=now host=your_host | stats count BY URL

obviously this search depends on the extracted fields.

Ciao.

Giuseppe

Re: URLs by host

waJesu — Thu, 10 Oct 2024 14:59:29 GMT

Thank you for your prompt response and help. Logs are coming from other sources e.g firewall. Maybe I should have used hostname/computername that is reaching out to those URLs

Re: URLs by host

gcusello — Thu, 10 Oct 2024 16:23:19 GMT

Hi @waJesu ,

exactly define your requirement and match it to your fields, then it's easy to use commands.

Ciao.

Giuseppe