Create a request with 2 reseach - Splunk Community

Splunk Search

Hello,

Is it possible to create a request in which we ask to give the top requested URL for each IP.

Something like :

index="cisco" | foreach src_ip [stats count by cs_url_host]

did you tried with the chart command?

something like this:

index="cisco"
| chart count OVER src_ip BY cs_url_host

Ciao.

Giuseppe

Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...