topic Re: Search users who access url1, url2 but not url3 in Splunk Search

Search users who access url1, url2 but not url3

xuguang — Mon, 16 Jun 2014 03:38:51 GMT

I am analyzing Apache web access log and want to search all clientip who accessed url1, url2 but not url3. Meanwhile, I also want the list who accessed url1, url2, url3, url4. How to implement it?

Re: Search users who access url1, url2 but not url3

MuS — Mon, 16 Jun 2014 07:07:29 GMT

Hi xuguang,

try something like this:

clientip (url1 OR url2) NOT url3

or if your second request is like who accessed either of the url's

clinetip url1 OR url2 OR url3 OR url4

hope this helps ...

cheers, MuS

Re: Search users who access url1, url2 but not url3

martin_mueller — Mon, 16 Jun 2014 18:28:16 GMT

For your first part you could do this:

sourcetype=your_access_logs (url=url1 OR url=url2 OR url=url3) | chart count over url by clientip | where url1>0 AND url2>0 AND url3=0

The second bit works similarly:

sourcetype=your_access_logs (url=url1 OR url=url2 OR url=url3 OR url=url4) | chart count over url by clientip | where url1>0 AND url2>0 AND url3>0 AND url4>0