Splunk Search

Looking for a way to display sub items, kind of like pivot table in Excel.

oleg106
Explorer

Hi, I am looking to display results a certain way and want to know if this is possible in Splunk. We have proxy logs that contain URLs and client IPs. I want to group by URLs (top 20) and display all IPs that connected to them. I want the output to look something like this,,

Url CountOfConnections

..Client IP list

google.com 3

...192.168.1.2

...192.168.1.7

...192.168.1.3

yahoo.com 2

...192.168.1.2

...192.168.1.3

Basically a visually simple way to distinguish urls and clients.

Doing something like "top 20 url ip" doesn't look good for this type of report. Thanks!

Tags (2)
0 Karma

BobM
Builder

would this be what you want?

| stats values(ip) as IPs by url
0 Karma

BobM
Builder

so add another function.

| stats values(ip) as IPs dc(ip) as ipCount by url | sort - ipCount

0 Karma

oleg106
Explorer

Thanks, but that's no quite it. I already tried it before. It doesn't give me a count for each site, and also I can't figure out a way to sort it by # of IPs per url.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...