How to search to get list of URLs/domains in my logs in a particular period?

[waJesu]

I am new to Splunk and I need help to get a query that lists all the domains that are in my logs (that were accessed from my network or that accessed my network) at any given period or range

[gcusello · Accepted solution]

Hi @waJesu,

yes, it's an easy job, having some sample of your data.

Anyway supponing that you have these logs in an index called "your_index" and that the url field is already extracted by the TA you used (and it's called "uri", you should run something like this:

index=your_index
| stats count BY uri

If you don't have the uri field you have to extract it using the rex command, but, to help you I need a sample of your data.

Anyway, I hint to use the Splunk Search Tutorial 

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/SearchTutorial/WelcometotheSearchTutorial

Ciao.

Giuseppe

[gcusello]

Hi @waJesu,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉