Splunk Search

How to generate a search to find uncategorized URLS in IronPort?

pradeep577
Path Finder

Hi,

I'm new to Splunk area.

We have integrated Splunk with ironports. I need to search number of history to a particular website category for one hour. how do i go about it?

Thank you in advance

Tags (4)
0 Karma
1 Solution

pradeep577
Path Finder

I tried like this x_webcat_code_full="Uncategorized URLs"

i did get results.

View solution in original post

0 Karma

pradeep577
Path Finder

I tried like this x_webcat_code_full="Uncategorized URLs"

i did get results.

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi pradeep577,

If you want hour as timescale, use the bin option.

... | bin _time span=1h | stats ...

I don't know your exact data structure, but assuming the site field captures which websites were accessed, you can use the search below to how hourly access counts to a specific website, or create a chart access counts by sites on an hourly basis:

  1. souretype="cisco:esa:http" | bin
    _time span=1h | stats count(eval(site=yourwebsite)) by
    _time

    souretype="cisco:esa:http" | bin _time span=1h | chart count over _time by site

Hope this helps. Thanks!
Hunter

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...