How to generate a search to find uncategorized URLS in IronPort?

[pradeep577]

Hi,

I'm new to Splunk area.

We have integrated Splunk with ironports. I need to search number of history to a particular website category for one hour. how do i go about it?

Thank you in advance

[pradeep577 · Accepted solution]

I tried like this x_webcat_code_full="Uncategorized URLs"

i did get results.

[hunters_splunk]

Hi pradeep577,

If you want hour as timescale, use the bin option.

... | bin _time span=1h | stats ...

I don't know your exact data structure, but assuming the site field captures which websites were accessed, you can use the search below to how hourly access counts to a specific website, or create a chart access counts by sites on an hourly basis:

1. souretype="cisco:esa:http" | bin
   _time span=1h | stats count(eval(site=yourwebsite)) by
   _time

   souretype="cisco:esa:http" | bin _time span=1h | chart count over _time by site

Hope this helps. Thanks!
Hunter