Archive

Can you help me make a visualization from the results of a regex search, which collects domains from Meraki URL Logs?

Explorer

I am new to Splunk and currently have Meraki URL logs being set to Splunk. I have written a regex search to show just the domain from each URL. For example "splunk.com". I am trying to find a way to categorize them into certain categories such as Social Media, Shopping, Education, etc. This would allow for me to display how the free wifi my company is providing is being used, in a more visually pleasing way.

I don't really know how to start with this. Any advice would be greatly appreciated.

0 Karma

Path Finder

I think an eval case could fit nicely

| eval category=case(like(URL, "%marketing"),"marketing" OR like(URL, "%Shopping%"), "Shopping" OR like(URL, "%Education%"), "Education" OR like(URL, "%Socialmedia%"), "Social media" , true(), "other")  | stats count by category
0 Karma

Explorer

Thank you for your help! I don't think this would work because I have so many URLs that I would not be able to write a like statement for all of them.

0 Karma

Contributor

Can you provide a little bit more information like sample event or so?

0 Karma