Splunk Search

How do you find common information between two users in a proxy log?

pinkyyu
Explorer

how do I get common information from two users in a proxy log?

for example, i would like to find whether a URL that both of the users have accessed in a particular period of time.

user=ABC OR user=XYZ tag=proxy 
http_user_agent=mozilla* OR http_user_agent=firefox* |associate
0 Karma

woodcock
Esteemed Legend

Like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo
AND (user=ABC OR user=XYZ tag=proxy)
AND (http_user_agent=mozilla* OR http_user_agent=firefox*)
| stats dc(user) AS num_users values(_time) BY URL
| where num_users > 1
0 Karma

adonio
Ultra Champion

assuming you have a field calledurl and you cant to see how many users touched it in a period of time, you can do something like this: (here for a 5 minutes period)
... your search ... | bin span=5m _time| stats dc(user) as unique_users values(user) as user_names by url ...
that will show how many unique users and their names touched each url (values of url field) in a 5 minutes timeframe
you can expand and see overtime:
... your search ... (user=a OR user=b OR user=c) (url=1 OR url=2 OR url=3) | timechart span=5m dc(user) as unique_users by url

hope it helps

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...