Splunk Search

Counting total unique urls grouped by a particular parameter

kbcuait
Explorer

Hi, looking at website log file

Would like to see how many unique instances of a certain parameter there are

The part of the log looks like this: "GET /filname.php?userid=114139&anotherparameter HTTP/1.1"

Do I need to use a regular expression to try and match the userid field? If so, how would I incorporate that into the search?

Thanks 🙂

Tags (4)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I'm not exactly sure what your desired end result is, but it sounds a lot like a job for stats. That would look something like this:

sourcetype="log_file" filename.php | stats dc(uri) as unique_uris by userid

This will compute a distinct count of uris per userid.

kbcuait
Explorer

Thanks I'll give this a try 🙂

0 Karma

kbcuait
Explorer

Ok I've begun my own question to an extent

I ended up clicking on the uri field in the left column, then under Charts, "Top values overall" which generated a search like this:

sourcetype="log_file" filename.php | top limit=10000 uri

I can now count, avg, etc. 🙂

If anyone has a better answer I would welcome it

0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...