URLs by host

[waJesu]

I need a query that lists URLs a particular host has reached out in a particular time e.g in the last 24 hours. Please help

[gcusello]

Hi @waJesu ,

if host is the host sending the logs and url is a fied in your logs, youcould run something like this:

index=your_index sourcetype=your_sourcetype earliest=-24h latest=now host=your_host
| stats count BY URL

obviously this search depends on the extracted fields.

Ciao.

Giuseppe

[waJesu]

Thank you for your prompt response and help. Logs are coming from other sources e.g firewall. Maybe I should have used hostname/computername that is reaching out to those URLs

[gcusello]

Hi @waJesu ,

exactly define your requirement and match it to your fields, then it's easy to use commands.

Ciao.

Giuseppe