Splunk Search

Unique requests

d00m4ig
Engager

Need creating a search query for Splunk that results in a list of unique requests that have been completed.

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index=_* sourcetype="audittrail"
| rex "(?ms)search='(?<search>.*)$$"
| rex field=search mode=sed "s/', autojoin='1',.*$$//"
| regex search="(^|[\s\\r\n(])sourcetype\s*=\s*\"?(?i)(wmi:)?(win|xml)eventlog(\*|:\*|:system|:security|:application)"
| stats dc(search)

View solution in original post

woodcock
Esteemed Legend

Like this:

index=_* sourcetype="audittrail"
| rex "(?ms)search='(?<search>.*)$$"
| rex field=search mode=sed "s/', autojoin='1',.*$$//"
| regex search="(^|[\s\\r\n(])sourcetype\s*=\s*\"?(?i)(wmi:)?(win|xml)eventlog(\*|:\*|:system|:security|:application)"
| stats dc(search)

d00m4ig
Engager

Thank you very much!

0 Karma

jkat54
SplunkTrust
SplunkTrust

... | stats dc(someField)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...