Splunk Search

Counting total unique urls grouped by a particular parameter

kbcuait
Explorer

Hi, looking at website log file

Would like to see how many unique instances of a certain parameter there are

The part of the log looks like this: "GET /filname.php?userid=114139&anotherparameter HTTP/1.1"

Do I need to use a regular expression to try and match the userid field? If so, how would I incorporate that into the search?

Thanks :slightly_smiling_face:

Tags (4)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I'm not exactly sure what your desired end result is, but it sounds a lot like a job for stats. That would look something like this:

sourcetype="log_file" filename.php | stats dc(uri) as unique_uris by userid

This will compute a distinct count of uris per userid.

kbcuait
Explorer

Thanks I'll give this a try :slightly_smiling_face:

0 Karma

kbcuait
Explorer

Ok I've begun my own question to an extent

I ended up clicking on the uri field in the left column, then under Charts, "Top values overall" which generated a search like this:

sourcetype="log_file" filename.php | top limit=10000 uri

I can now count, avg, etc. :slightly_smiling_face:

If anyone has a better answer I would welcome it

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...