Hi there,
I hope you can help me. I use the URL Toolbox to get the domain of my proxy logs.
lookup ut_parse_extended_lookup url | table ut_domain count | sort -count | head 100
These are the search results in the following table:
ut_domain count
google.com 1000
heise.de 500
yahoo.com 20
google.com 200
yahoo.com 100
There are about 10,000 more URLs, some of them very often.
I want a table with every unique URL, but the counts summed like:
ut_domain count
google.com 1200
heise.de 500
yahoo.com 120
Has anyone an idea? Thank you very much.
Try this.
lookup ut_parse_extended_lookup url | stats sum(count) as Count by ut_domain | table ut_domain Count | sort -Count | head 100
it's working, thanks 🙂
Like this:
.... lookup ut_parse_extended_lookup url | table ut_domain count | stats sum(count) AS count by ut_domain | sort -count | head 100
Try this.
lookup ut_parse_extended_lookup url | stats sum(count) as Count by ut_domain | table ut_domain Count | sort -Count | head 100