- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to show the top command with distinct value?
igschloessl
Explorer
03-11-2019
11:50 PM
I've got proxy logs and I want to show the top 5 urls and for that the count of distinct users who tried to access it.
I tried the following search command
index=proxy
| eval dc_user=[search* stats dc(user) by url| return $dc_user]
| top dest_host limit=5
| table dest_host dc_user
How can I get this work?
I also wanted to add the count of the url and the percentage.
Thank you in advance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
cpmoone
Engager
03-13-2019
08:40 AM
Does this do what you need?
index=proxy
| eventstats dc(user) as unique_users by url
| top url
| sort 5 - count
| table url, unique_users, count, percent
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

somesoni2
Revered Legend
03-12-2019
06:57 AM
Give this a try
index=proxy
| stats dc(user) as UniqUsers count by dest_host
| sort 5 -count
