Getting Data In

How to search to get list of URLs/domains in my logs in a particular period?

waJesu
Path Finder

I am new to Splunk and I need help to get a query that lists all the domains that are in my logs (that were accessed from my network or that accessed my network) at any given period or range

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @waJesu,

yes, it's an easy job, having some sample of your data.

Anyway supponing that you have these logs in an index called "your_index" and that the url field is already extracted by the TA you used (and it's called "uri", you should run something like this:

index=your_index
| stats count BY uri

If you don't have the uri field you have to extract it using the rex command, but, to help you I need a sample of your data.

Anyway, I hint to use the Splunk Search Tutorial 

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/SearchTutorial/WelcometotheSearchTutorial

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @waJesu,

yes, it's an easy job, having some sample of your data.

Anyway supponing that you have these logs in an index called "your_index" and that the url field is already extracted by the TA you used (and it's called "uri", you should run something like this:

index=your_index
| stats count BY uri

If you don't have the uri field you have to extract it using the rex command, but, to help you I need a sample of your data.

Anyway, I hint to use the Splunk Search Tutorial 

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/SearchTutorial/WelcometotheSearchTutorial

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @waJesu,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...