Splunk Search

Basic search help

amagson
Loves-to-Learn

Hello all,

I need a hand with a basic Splunk search. I appreciate this is Splunk 101 basics, but with other commitments, I am struggling to remember all commands. 

What I need is to edit the following search, (or someone kind enough to completely improve the search), that rather the showing the same day next to each URL in the field "day", it just shows all URLs next to one single entry of the day. hopefully, that makes sense?

index=netproxy user=(user) (url=https://www* OR url=http://www.)
| stats count by day, url

day                                    url                                                                   count

Mon, 13 Dec 2021    https://www.bizographics.com/         1
Mon, 13 Dec 2021 https://www.bleacherbreaker.com/     2788
Mon, 13 Dec 2021 https://www.google-analytics.com/     3
Mon, 13 Dec 2021 https://www.google.co.uk/                       5                    
Mon, 13 Dec 2021 https://www.googletagmanager.com/ 10
Mon, 13 Dec 2021 https://www.googletagservices.com/  6
Sat, 11 Dec 2021 https://www.capitalfm.com/                     23
Sat, 11 Dec 2021 https://www.capitalxtra.com/                   26
Sat, 11 Dec 2021 https://www.globalplayer.com/                 8

 

Basically what I am after is a search that shows,  - 

 

day                                             url                                            times visited(count)
Mon, 13 Dec 2021    https://www.bizographics.com/            1
                                          https://www.bleacherbreaker.com/      2788
                                          https://www.google-analytics.com/      3
                                          https://www.google.co.uk/                         5
                                          https://www.googletagmanager.com/   10
                                          https://www.googletagservices.com/   5

If anyone can improve on my basic search it would be greatly appreciated

Labels (1)
0 Karma

amagson
Loves-to-Learn

that works well thank you 🙂

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=netproxy user=(user) (url=https://www* OR url=http://www.)
| stats count by day, url
| stats list(url) as url list(count) as count by day
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...