Splunk Search

How can I track employees' website usage?

jVolpi
New Member

Hello

My firm currently has the dashboard below that shows top employees utilization and top sites visited.
I am looking for a way to query how may times a person has or remote office has hit a certain site and how much utilization it is using.

index="istr_security" sourcetype=bcoat_proxysg 10.X.X.  | rex field=_raw "^\S+ \S+ \S+ (?\S+)"   | rex field=_raw "(?[a-z]+://(?[^:/]+)\S+) (?\d+)"   | rex field=fqdn "(?[^.]+\.[^.]+)$"   | rex field=_raw "(?\d+) (?\d+) (?\d+)"   | eval server_mbytes=round(server_bytes/1000000,2)    | eval duration_secs=round(duration_msecs/1000,2)    | timechart useother=0 sum(server_mbytes) by corpid

Thank you

0 Karma

sundareshr
Legend

Try this

index="istr_security" sourcetype=bcoat_proxysg 10.X.X. "*certainsite.com"| rex field=_raw "^\S+ \S+ \S+ (?\S+)" | rex field=_raw "(?[a-z]+://(?[^:/]+)\S+) (?\d+)" | rex field=fqdn "(?[^.]+.[^.]+)$" | rex field=_raw "(?\d+) (?\d+) (?\d+)" | eval server_mbytes=round(server_bytes/1000000,2) | eval duration_secs=round(duration_msecs/1000,2) | stats count sum(server_mbytes) as mbytes by corpid
0 Karma

jVolpi
New Member

Thank you. I tried to copy and paste this into the code field and tweaked the IP to reflect our proxy server and seem to run into a snag.

Error in 'rex' command: Encountered the following error while compiling the regex '^\S+ \S+ \S+ (?\S+)': Regex: unrecognized character after (? or (?- 
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...