Splunk Search

How do you find common information between two users in a proxy log?

New Member

how do I get common information from two users in a proxy log?

for example, i would like to find whether a URL that both of the users have accessed in a particular period of time.

user=ABC OR user=XYZ tag=proxy 
http_user_agent=mozilla* OR http_user_agent=firefox* |associate
0 Karma

Esteemed Legend

Like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo
AND (user=ABC OR user=XYZ tag=proxy)
AND (http_user_agent=mozilla* OR http_user_agent=firefox*)
| stats dc(user) AS num_users values(_time) BY URL
| where num_users > 1
0 Karma

Ultra Champion

assuming you have a field calledurl and you cant to see how many users touched it in a period of time, you can do something like this: (here for a 5 minutes period)
... your search ... | bin span=5m _time| stats dc(user) as unique_users values(user) as user_names by url ...
that will show how many unique users and their names touched each url (values of url field) in a 5 minutes timeframe
you can expand and see overtime:
... your search ... (user=a OR user=b OR user=c) (url=1 OR url=2 OR url=3) | timechart span=5m dc(user) as unique_users by url

hope it helps

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...