I am new to Splunk and currently have Meraki URL logs being set to Splunk. I have written a regex search to show just the domain from each URL. For example "splunk.com". I am trying to find a way to categorize them into certain categories such as Social Media, Shopping, Education, etc. This would allow for me to display how the free wifi my company is providing is being used, in a more visually pleasing way.
I don't really know how to start with this. Any advice would be greatly appreciated.
I think an eval case could fit nicely
| eval category=case(like(URL, "%marketing"),"marketing" OR like(URL, "%Shopping%"), "Shopping" OR like(URL, "%Education%"), "Education" OR like(URL, "%Socialmedia%"), "Social media" , true(), "other") | stats count by category