Splunk Search

How do you find common information between two users in a proxy log?

pinkyyu
New Member

how do I get common information from two users in a proxy log?

for example, i would like to find whether a URL that both of the users have accessed in a particular period of time.

user=ABC OR user=XYZ tag=proxy 
http_user_agent=mozilla* OR http_user_agent=firefox* |associate
0 Karma

woodcock
Esteemed Legend

Like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo
AND (user=ABC OR user=XYZ tag=proxy)
AND (http_user_agent=mozilla* OR http_user_agent=firefox*)
| stats dc(user) AS num_users values(_time) BY URL
| where num_users > 1
0 Karma

adonio
Ultra Champion

assuming you have a field calledurl and you cant to see how many users touched it in a period of time, you can do something like this: (here for a 5 minutes period)
... your search ... | bin span=5m _time| stats dc(user) as unique_users values(user) as user_names by url ...
that will show how many unique users and their names touched each url (values of url field) in a 5 minutes timeframe
you can expand and see overtime:
... your search ... (user=a OR user=b OR user=c) (url=1 OR url=2 OR url=3) | timechart span=5m dc(user) as unique_users by url

hope it helps

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...