Splunk Search

Search users who access url1, url2 but not url3

xuguang
New Member

I am analyzing Apache web access log and want to search all clientip who accessed url1, url2 but not url3. Meanwhile, I also want the list who accessed url1, url2, url3, url4. How to implement it?

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

For your first part you could do this:

sourcetype=your_access_logs (url=url1 OR url=url2 OR url=url3) | chart count over url by clientip | where url1>0 AND url2>0 AND url3=0

The second bit works similarly:

sourcetype=your_access_logs (url=url1 OR url=url2 OR url=url3 OR url=url4) | chart count over url by clientip | where url1>0 AND url2>0 AND url3>0 AND url4>0

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

For your first part you could do this:

sourcetype=your_access_logs (url=url1 OR url=url2 OR url=url3) | chart count over url by clientip | where url1>0 AND url2>0 AND url3=0

The second bit works similarly:

sourcetype=your_access_logs (url=url1 OR url=url2 OR url=url3 OR url=url4) | chart count over url by clientip | where url1>0 AND url2>0 AND url3>0 AND url4>0

MuS
Legend

Hi xuguang,

try something like this:

clientip (url1 OR url2) NOT url3

or if your second request is like who accessed either of the url's

clinetip url1 OR url2 OR url3 OR url4

hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...