Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Search with 3 fields and count
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm trying to create a table which shows the following: -
Domain Client_IP Client_User Count
www.google.com 192.168.1.100 manwin 5
www.spurs-sg.org 192.168.1.101 User2 10
I can get a table showing me
Domain Client_IP Count
by doing the following search
sourcetype="bcoat_proxysg" |top limit=100 Domain by Client_IP
but I can't find a way to add in the user.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can do
sourcetype="bcoat_proxysg" |top limit=100 Domain by Client_IP, Client_User
More info on top: http://www.splunk.com/base/Documentation/latest/SearchReference/Top
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can do
sourcetype="bcoat_proxysg" |top limit=100 Domain by Client_IP, Client_User
More info on top: http://www.splunk.com/base/Documentation/latest/SearchReference/Top
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks I've given it a tick. Thanks for your response.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Feel free to accept usable answers -- helps close out the question and makes the site more usable for new users especially. Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks, I just tested with my sample data and it worked.......
Interestingly when I was testing the exact same command at my customer's location it did not give me any results.
Building Reliable Asset and Identity Frameworks in Splunk ES
Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting
Automatic Discovery Part 3: Practical Use Cases
