how to aggregate log entries

mchan — Fri, 11 Nov 2011 06:22:30 GMT

Newbie to splunk, but I want to aggregate the log entries below based upon if it's the same ip address and request url.

192.168.8.5     [10/Nov/2011:11:11:23] "GET /hello/world HTTP/1.1" 200 1234
192.168.8.7     [10/Nov/2011:15:46:23] "GET /foo/bar HTTP/1.1" 200 124
192.168.8.5     [10/Nov/2011:18:00:25] "GET /foo/bar HTTP/1.1" 200 124
192.168.8.10    [10/Nov/2011:23:11:23] "GET /hello/world HTTP/1.1" 200 1234
192.168.8.5     [10/Nov/2011:23:59:00] "GET /hello/world HTTP/1.1" 200 1234

So the outcome I would like is as follows:

ip address      request url                     count      
192.168.8.5     "GET /hello/world HTTP/1.1"     2 
192.168.8.7     "GET /foo/bar HTTP/1.1"         1
192.168.8.5     "GET /foo/bar HTTP/1.1"         1
192.168.8.10    "GET /hello/world HTTP/1.1"     1

Can someone provide some insight? I've played around with dedup and distinct_count but can't seem to get it right to get the aggregated information from splunk.

Thanks in advance.

Re: how to aggregate log entries

hjwang — Mon, 28 Sep 2020 10:05:29 GMT

just search ... | stats count by ip_address,request_url can do for this

Re: how to aggregate log entries

kristian_kolb — Fri, 11 Nov 2011 07:21:13 GMT

Hi,

Given that you have extracted the fields as clientip and url

   <your base search here> | stats count by clientip url

should produce the desired results.

hope this helps,

/Kristian

topic how to aggregate log entries in Splunk Search

how to aggregate log entries

Re: how to aggregate log entries

Re: how to aggregate log entries