Search common url visited by multiple users

Splunk Enterprise Security

How do i make a query for proxy logs to check multiple users visiting the same links

I good start using the datamodel accelerated data from ES is: | tstats summariesonly=true dc(Web.user) from datamodel=Web by Web.url

Get Updates on the Splunk Community!

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Are you a member of the Splunk Community?