Working with some Apache logs. I am trying to get a table that displays the uri, the clientip, and the number of times that clientip has hit that uri (as hits). Everything is working as expected except for that table. Why doesn't the uri part work? I get a table with uri that has blank values, and the other fields show the expected values.
index=* clientip=* uri=*
| stats count(uri) AS hits by clientip
| table uri, hits, clientip
Hi @adamfrisbee ,
you cannot display uri because after the stats command, you can display only the fields present in stats and in you stats command there isn't the uri value.
If you want it, you should modify your search in this way:
index=* clientip=* uri=*
| stats count(uri) AS hits values(uri) AS uri by clientip
| table uri hits clientip
Ciao.
Giuseppe
Hi @adamfrisbee ,
you cannot display uri because after the stats command, you can display only the fields present in stats and in you stats command there isn't the uri value.
If you want it, you should modify your search in this way:
index=* clientip=* uri=*
| stats count(uri) AS hits values(uri) AS uri by clientip
| table uri hits clientip
Ciao.
Giuseppe
Hi @adamfrisbee,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉