https://community.splunk.com/t5/Splunk-Search/Viewing-URLs-by-IP-over-time/m-p/11541#M800 <P>I didn't see the webcast, but I guess I would do it with something like:</P> <PRE><CODE>sourcetype=access_combined | stats list(uri) by clientip </CODE></PRE> Thu, 15 Apr 2010 23:32:34 GMT gkanapathy 2010-04-15T23:32:34Z https://community.splunk.com/t5/Splunk-Search/Viewing-URLs-by-IP-over-time/m-p/11540#M799 <P>In the Splunk 4.1 webcast earlier this week, one of the presenters showed a combined_access report that looked to produce a report of the user's IP address and then indented the URLs they viewed sorted by time. There may have been more columns.</P> <P>I looked to see if their was a recording or similar question here, but didn't see anything. Does anyone know how he did that as it looked useful was seeing how people migrate through your site.</P> Thu, 15 Apr 2010 10:24:38 GMT https://community.splunk.com/t5/Splunk-Search/Viewing-URLs-by-IP-over-time/m-p/11540#M799 prodport 2010-04-15T10:24:38Z https://community.splunk.com/t5/Splunk-Search/Viewing-URLs-by-IP-over-time/m-p/11541#M800 <P>I didn't see the webcast, but I guess I would do it with something like:</P> <PRE><CODE>sourcetype=access_combined | stats list(uri) by clientip </CODE></PRE> Thu, 15 Apr 2010 23:32:34 GMT https://community.splunk.com/t5/Splunk-Search/Viewing-URLs-by-IP-over-time/m-p/11541#M800 gkanapathy 2010-04-15T23:32:34Z https://community.splunk.com/t5/Splunk-Search/Viewing-URLs-by-IP-over-time/m-p/11542#M801 <P>This could be the search:</P> <P>sourcetype="access_combined" | chart count by clientip,uri</P> Tue, 27 Apr 2010 02:29:15 GMT https://community.splunk.com/t5/Splunk-Search/Viewing-URLs-by-IP-over-time/m-p/11542#M801 Simeon 2010-04-27T02:29:15Z