Splunk Search

What is the best way to track URLs visited for a user?

ivar9692
Explorer

Hi, I want to know what url user visited after going to a particular url.

Suppose this is the url user visited (www.**cccc**.com), I want to know what pages he visited after that url.

[Please suggest a query for this, I have proxy logs in splunk]

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

Hi @ivar9692 - Did dperre's answer help solve your question at all? If yes, please don't forget to click "Accept" below the answer to resolve this post. Thanks!

0 Karma

dperre_splunk
Splunk Employee
Splunk Employee

Try this search. I don't know what your field names are but you could try this.

index=proxy_logs | transaction user startswith="www.trackedurl.com" maxevents=100

Edit:
Putting some context around the search and improving the search.
index=proxy_logs user=x #This searches the proxy_logs index for user X. You can change.
transaction user startswith="www.trackedurl.com" maxevents=100 # Join all of the results by the user starting with the www.trackedurl.com url then getting a maximum event number of 100. So from the start of the first www.trackedurl.com go to 100 later events. You can increase or lower this number.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Can we have some sample log entries? You probably need field extraction, if not already done, to capture pages and report from those fields.

0 Karma

ivar9692
Explorer

Hi somesoni,

I have bluecoat logs, indexed in splunk. I need to extract information from url field. Condition I want is : if someone visited url: www.###.com then after that what are the next 5 url he visited.
Note here output i need is users who visited www.####.com and next 5 websited they visited.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...