Report of sites visited by user (squid)


I have Splunk on both of my Squid proxies forwarding the access.log to our main Splunk installation. How would I create a report of distinct domains visited by user?

Tags (1)
0 Karma

Re: Report of sites visited by user (squid)

Super Champion

You should be able to do something like this:

host=squid* source=*access.log | stats count by domain, user

Or another possible grouping would be like:

host=squid* source=*access.log | stats count, values(domain) as domains by user

View solution in original post