Search users who access url1, url2 but not url3

[xuguang]

I am analyzing Apache web access log and want to search all clientip who accessed url1, url2 but not url3. Meanwhile, I also want the list who accessed url1, url2, url3, url4. How to implement it?

[martin_mueller · Accepted solution]

For your first part you could do this:

sourcetype=your_access_logs (url=url1 OR url=url2 OR url=url3) | chart count over url by clientip | where url1>0 AND url2>0 AND url3=0

The second bit works similarly:

sourcetype=your_access_logs (url=url1 OR url=url2 OR url=url3 OR url=url4) | chart count over url by clientip | where url1>0 AND url2>0 AND url3>0 AND url4>0

[MuS]

Hi xuguang,

try something like this:

clientip (url1 OR url2) NOT url3

or if your second request is like who accessed either of the url's

clinetip url1 OR url2 OR url3 OR url4

hope this helps ...

cheers, MuS