Dashboards & Visualizations

Can you help me make a visualization from the results of a regex search, which collects domains from Meraki URL Logs?

tylerflynn
Explorer

I am new to Splunk and currently have Meraki URL logs being set to Splunk. I have written a regex search to show just the domain from each URL. For example "splunk.com". I am trying to find a way to categorize them into certain categories such as Social Media, Shopping, Education, etc. This would allow for me to display how the free wifi my company is providing is being used, in a more visually pleasing way.

I don't really know how to start with this. Any advice would be greatly appreciated.

0 Karma

jlelli
Path Finder

I think an eval case could fit nicely

| eval category=case(like(URL, "%marketing"),"marketing" OR like(URL, "%Shopping%"), "Shopping" OR like(URL, "%Education%"), "Education" OR like(URL, "%Socialmedia%"), "Social media" , true(), "other")  | stats count by category
0 Karma

tylerflynn
Explorer

Thank you for your help! I don't think this would work because I have so many URLs that I would not be able to write a like statement for all of them.

0 Karma

MousumiChowdhur
Contributor

Can you provide a little bit more information like sample event or so?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!