Sub-Domain Count

[queme]

I am looking to pull all domains from dns logs and get a count of how many unique sub-domains that were requested of that domain.

This is what I have so far. I might be going in the wrong direction so if I need to wipe and retry I ok with that.

index=dns | rex field=named_domain "(?([^.]+.)?[^.]+$)" | stats count by named_domain | uniq | table domain, count

My problem is that the count is not the count of the unique sub-domains but instead of I am getting all sub-domains grouped with the domain field.

[sowings]

Your rex statement reads "look inside the field called 'named_domain' and capture <something DOT something>, and store the results in a field called 'domain'." Your stats call then sums over the original field named_domain; I suspect you're just dealing with a typo.

If I've missed the mark, maybe you could provide a couple samples lines (enough to spot a pattern) and the desired output?

[queme]

That worked great, thank you!

[sowings]

Perhaps stats distinct_count(name_domain) by domain is what you're looking for?

[queme]

The name_domain field contains the entire domain (tap-cdn.rubiconproject.com) and my rex field will pull from that and show just rubiconproject.com. (I found this in one of the answers and it works well) My problem is if there are 100 logs with a request to tap-cdn.rubiconproject.com it will show a count of 100. only want to see 1. If there is another sub-domain tap1-cdn.rubiconproject and tap-cdn.rubiconproject I want it to show 2.

What I want it to look like:

Domain | # of Sub-Domains
Facebook.com 12
abc.com 2

[queme]

Jul 3 02:19:31 query from IP: 1.1.1.1 Port#49335: Name: tap-cdn.rubiconproject.com. Destination: 2.2.2.2 Time: Jul 3 02:19:31

Jul 3 02:19:31 query from IP: 1.1.1.1 Port#65260: Name: api.echoenabled.com. Destination: 2.2.2.2 Time: Jul 3 02:19:31

Jul 3 02:20:56 query from IP: 1.1.1.1 Port#64937: Name: versatables-com.amazonwebstore.com. Destination: 2.2.2.2 Time: Jul 3 02:19:31

I changed the Ips for security reasons.