Splunk Search
Highlighted

Display fields in a table after stats command

Explorer

Working with some Apache logs. I am trying to get a table that displays the uri, the clientip, and the number of times that clientip has hit that uri (as hits). Everything is working as expected except for that table. Why doesn't the uri part work? I get a table with uri that has blank values, and the other fields show the expected values.

 

index=* clientip=* uri=* 
| stats count(uri) AS hits by clientip
| table uri, hits, clientip

 

 Screen Shot 2020-06-28 at 9.39.16 AM.png

 

Labels (3)
0 Karma
Highlighted

Re: Display fields in a table after stats command

Legend

Hi @adamfrisbee ,

you cannot display uri because after the stats command, you can display only the fields present in stats and in you stats command there isn't the uri value.

If you want it, you should modify your search in this way:

index=* clientip=* uri=* 
| stats count(uri) AS hits values(uri) AS uri by clientip
| table uri hits clientip

Ciao.

Giuseppe

View solution in original post

0 Karma