Splunk Search

I need complete this query find the top 5 viewed products referred by a domain.

EdwinOssa
Engager

This is my sentence but is not completed. I can't find the solution on Doc.

 

index=main sourcetype=acc* action=view [search sourcetype=acc* status=200 action=view | top limit=5 referer_domain | table referer_domain productName] | stats count,values(productName),distinct_count(productId) by referer_domain

Labels (1)
0 Karma
1 Solution

inventsekar
Ultra Champion

Hi @EdwinOssa your query is perfect one.. the field "productName" is not available. only "ProductId" is available. 

so, you could run:

index=main sourcetype=acc* action=view [search sourcetype=acc* status=200 action=view | top limit=5 referer_domain | table referer_domain] | stats count,values(productId),distinct_count(productId) by referer_domain

access.pngaccess1.png

View solution in original post

inventsekar
Ultra Champion

Hi @EdwinOssa your query is perfect one.. the field "productName" is not available. only "ProductId" is available. 

so, you could run:

index=main sourcetype=acc* action=view [search sourcetype=acc* status=200 action=view | top limit=5 referer_domain | table referer_domain] | stats count,values(productId),distinct_count(productId) by referer_domain

access.pngaccess1.png

EdwinOssa
Engager

Thank you so much for your help. Appreciated your time for reply my request. I'm new learning splunk and I have some difficulties to find some results. could you help me one last time with this query.

 

Plot a trellis chart showing the average time spent on the Buttercup Games website for each user session by browser.

-this is my solution but I'm stuck with the average.

index=main sourcetype=acc* referer_domain=http://www.buttercupgames.com action=view | top limit=20 useragent | chart avg(percent) 

after this I only got one line 

0 Karma

inventsekar
Ultra Champion

Sure @EdwinOssa , no problems.. i appreciate your questions and wish you best of luck for your splunk learnings .. (sorry for the late reply)

1) the "chart avg(percent)" is missing a "by" field.. generally

"chart avg(time_spent) by referer_domain"

Please check the search reference document for chart command syntax and examples:

https://docs.splunk.com/Documentation/Splunk/8.0.6/SearchReference/Chart#Basic_examples

2) the time_spent field is not available on the logs i think(i am not sure of the last number that appears on these logs.. that may be the time_spent, but i am not sure)

3) referer_domain is just 4 on these logs. so something missing on your requirement. 

Please let us know more details. 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...