Unique requests

[d00m4ig]

Need creating a search query for Splunk that results in a list of unique requests that have been completed.

[woodcock · Accepted solution]

Like this:

index=_* sourcetype="audittrail"
| rex "(?ms)search='(?<search>.*)$$"
| rex field=search mode=sed "s/', autojoin='1',.*$$//"
| regex search="(^|[\s\\r\n(])sourcetype\s*=\s*\"?(?i)(wmi:)?(win|xml)eventlog(\*|:\*|:system|:security|:application)"
| stats dc(search)

[d00m4ig]

Thank you very much!

[jkat54]

... | stats dc(someField)