I hope you can help me. I use the URL Toolbox to get the domain of my proxy logs.
lookup ut_parse_extended_lookup url | table ut_domain count | sort -count | head 100
These are the search results in the following table:
There are about 10,000 more URLs, some of them very often.
I want a table with every unique URL, but the counts summed like:
Has anyone an idea? Thank you very much.
lookup ut_parse_extended_lookup url | stats sum(count) as Count by ut_domain | table ut_domain Count | sort -Count | head 100
View solution in original post
it's working, thanks 🙂
.... lookup ut_parse_extended_lookup url | table ut_domain count | stats sum(count) AS count by ut_domain | sort -count | head 100