Solved: Unique requests - Splunk Community

Splunk Search

Need creating a search query for Splunk that results in a list of unique requests that have been completed.

1 Solution

Solution

Like this:

index=_* sourcetype="audittrail"
| rex "(?ms)search='(?<search>.*)$$"
| rex field=search mode=sed "s/', autojoin='1',.*$$//"
| regex search="(^|[\s\\r\n(])sourcetype\s*=\s*\"?(?i)(wmi:)?(win|xml)eventlog(\*|:\*|:system|:security|:application)"
| stats dc(search)

View solution in original post

Solution

Like this:

index=_* sourcetype="audittrail"
| rex "(?ms)search='(?<search>.*)$$"
| rex field=search mode=sed "s/', autojoin='1',.*$$//"
| regex search="(^|[\s\\r\n(])sourcetype\s*=\s*\"?(?i)(wmi:)?(win|xml)eventlog(\*|:\*|:system|:security|:application)"
| stats dc(search)

Thank you very much!

... | stats dc(someField)

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them. As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...