Splunk Enterprise
Highlighted

Check what URLs are called

New Member

New to Splunk, so a bit of a basic question

I need to have a list of all URLs that are called by the User on the PC Splunk is running on. It doesnt matter if all URLs or called by a specific application. How can I implement this to Splunk?

Tags (3)
0 Karma
Highlighted

Re: Check what URLs are called

Legend

Do you mean URLs internal to Splunk or a client/server with Splunk Forwarder which is trying to access external URLs?

0 Karma
Highlighted

Re: Check what URLs are called

New Member

Actually I'm just trying to get a list in Splunk when, which user called what URL ond any Website (like google.com in Google Chrome), same way as I can see all Applications called by the user

0 Karma
Highlighted

Re: Check what URLs are called

Builder

Are you referring to Splunk URLs? For example, https://localhost:8000/en-US/app/search/search and https://localhost:8000/en-US/app/search/search?q=search%20index%3D*&sid=1552910209.54&display.page.s...

If so, you can run a query such as
index=_internal sourcetype=splunk_web_access | stats count by uri

0 Karma
Highlighted

Re: Check what URLs are called

New Member

I'm trying to get a list in Splunk when, which user called what URL ond any Website (like google.com in Google Chrome), same way as I can see all Applications called by the user.

0 Karma
Highlighted

Re: Check what URLs are called

Builder

If you have data in an index such as weblogs, you would do a search such as
index=weblogs sourcetype=access_combined OR sourcetype=iis | eval full_path=uri_domain.uri_path| stats values(full_path) by user

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.