Table wont show on search

[jacksonchandler]

Hi,

Im trying to collate URL domain names of users who visit websites over the course of 24 hours. It pulls the right data but it wont table and im not sure how to fix it.  Im using URL Toolbox to parse the domain out. 

index="##" eventtype=pan $user$ hoursago=24
| eval list="mozilla"
| `ut_parse_extended(url,list)`
| stats count by ut_domain_without_tld
| table ut_domain_without_tld count

Im fairly new to splunk so any help is appreciated.

[jacksonchandler]

Thanks Guiseppe. I solved it myself with your advice - data was there but wasnt showing as a table because my dashboard wasnt configured to do that - was to be shown as a list. Changed that and worked!

[gcusello]

Hi @jacksonchandler ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello · Accepted solution]

Hi @jacksonchandler ,

let me understand:

if you run the search without the last row (the table command) does ir run and does you have results?

if yes, remove the last row, also because you don't need it.

if not, run the search without the last two rows and check if the field ut_domain_without_tld is present.

Could you share the content of the macro?

if you use <CTRL><SHIFT>E on the search with the macro, you can have the full search (without macro) displayed in a window.

Ciao.

Giuseppe