https://community.splunk.com/t5/Splunk-Search/Top-Url-by-place-for-summary-indexing/m-p/92260#M23805 <P>I found my answer. If it can help :</P> <P>sourcetype="bcoat_proxysg" filter_result!="DENIED" http_response=200 http_content_type="text/html" | top category limit=20 by organisme</P> <P>So simple that I lose mysefl searching a very dificult querry !</P> <P>Olivier</P> Mon, 28 Sep 2020 13:23:44 GMT o_calmels 2020-09-28T13:23:44Z https://community.splunk.com/t5/Splunk-Search/Top-Url-by-place-for-summary-indexing/m-p/92259#M23804 <P>Hi, I found on this forum the following search : top 10 URL for top 10 Users.</P> <P>I modify this search to comply with my bluecoat Logs (get top 10 URL (dest_host) for top all organisme):</P> <PRE><CODE>sourcetype="bcoat_proxysg" filter_result!="DENIED" http_response=200 http_content_type="text/html| eventstats count AS total by organisme | stats count first(total) AS total BY organisme dest_host | sort - count | stats list(count) AS count list(dest_host) AS url first(total) AS total by organisme | sort - total | fields - total | eval url=mvindex(url, 0, 30)| eval count=mvindex(count, 0, 30)g </CODE></PRE> <P>My problem is that the result is grouped by organisme : Each result line is containing one time the organisme name and the 30 entries for each URL:</P> <P>I would like to get on each single line every information <BR /><BR /> Result#1 = organisme 1 URL1<BR /><BR /> Result#2 = organisme 1 URL2<BR /><BR /> Result#3 = organisme 1 URL3<BR /><BR /> Result#4 = organisme 1 URL4<BR /><BR /> ...<BR /> Result#X = organisme 2 URL1<BR /><BR /> Result#X = organisme 2 URL2<BR /><BR /> Result#X = organisme 2 URL3<BR /><BR /> Result#X = organisme 2 URL4<BR /><BR /> ...</P> <P>My aim is to populate a summary indexing on with I will generate Web activity for every organisme each month.</P> <P>Thanks a lot.</P> <P>Olivier.</P> Fri, 18 Jan 2013 16:22:34 GMT https://community.splunk.com/t5/Splunk-Search/Top-Url-by-place-for-summary-indexing/m-p/92259#M23804 o_calmels 2013-01-18T16:22:34Z https://community.splunk.com/t5/Splunk-Search/Top-Url-by-place-for-summary-indexing/m-p/92260#M23805 <P>I found my answer. If it can help :</P> <P>sourcetype="bcoat_proxysg" filter_result!="DENIED" http_response=200 http_content_type="text/html" | top category limit=20 by organisme</P> <P>So simple that I lose mysefl searching a very dificult querry !</P> <P>Olivier</P> Mon, 28 Sep 2020 13:23:44 GMT https://community.splunk.com/t5/Splunk-Search/Top-Url-by-place-for-summary-indexing/m-p/92260#M23805 o_calmels 2020-09-28T13:23:44Z