Splunk Search

Unique requests

Engager

Need creating a search query for Splunk that results in a list of unique requests that have been completed.

Tags (3)
0 Karma
1 Solution

Esteemed Legend

Like this:

index=_* sourcetype="audittrail"
| rex "(?ms)search='(?<search>.*)$$"
| rex field=search mode=sed "s/', autojoin='1',.*$$//"
| regex search="(^|[\s\\r\n(])sourcetype\s*=\s*\"?(?i)(wmi:)?(win|xml)eventlog(\*|:\*|:system|:security|:application)"
| stats dc(search)

View solution in original post

Esteemed Legend

Like this:

index=_* sourcetype="audittrail"
| rex "(?ms)search='(?<search>.*)$$"
| rex field=search mode=sed "s/', autojoin='1',.*$$//"
| regex search="(^|[\s\\r\n(])sourcetype\s*=\s*\"?(?i)(wmi:)?(win|xml)eventlog(\*|:\*|:system|:security|:application)"
| stats dc(search)

View solution in original post

Engager

Thank you very much!

0 Karma

SplunkTrust
SplunkTrust

... | stats dc(someField)

0 Karma