Splunk Search

URLs by host

waJesu
Path Finder

I need a query that lists URLs a particular host has reached out in a particular time e.g in the last 24 hours. Please help

Labels (1)
Tags (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @waJesu ,

if host is the host sending the logs and url is a fied in your logs, youcould run something like this:

index=your_index sourcetype=your_sourcetype earliest=-24h latest=now host=your_host
| stats count BY URL

obviously this search depends on the extracted fields.

Ciao.

Giuseppe

0 Karma

waJesu
Path Finder

Thank you for your prompt response and help. Logs are coming from other sources e.g firewall. Maybe I should have used hostname/computername that is reaching out to those URLs

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @waJesu ,

exactly define your requirement and match it to your fields, then it's easy to use commands.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...