captures users sum by url by date

[sdagostino]

I need to add something to the following search string (or rewrite it) that captures the following;

1. User
2. Destination URL
3. Number of times the user accessed the Destination URL per day
4. total number of hits to the Destination URL.

This search string

host="192.168.105.25" Prism http://DCSPRSAPPTS01.chpnet.org:80//Citrix/MetaFrame action="POST"| stats count by user, dest_url

Generates the following results

user     dest_url                                                               Count
phtwe    http://DCSPRSAPPTS01.chpnet.org:80//Citrix/MetaFrame/auth/login.aspx   99 
nkhan    http://DCSPRSAPPTS01.chpnet.org:80//Citrix/MetaFrame/auth/login.aspx   83 

[gkanapathy]

Do you just want the equivalent of:

 ... | bucket _time span=1d | stats count by _time,user,dest_url

Seems to me that's it. If you want the total for each URL, you can get it by adding:

 ... | eventstats sum(count) as total_count by _time,dest_url

or there is a trick you can do by creating a multivalued field:

... | eval user=user+";"+"*" | eval user=split(user,";") | bucket _time span=1d | stats count by _time,user,dest_url

which will put the total count as the * user. You can use any value besides * if it doesn't conflict with a real user name.

[sideview]

Note: I just improved the formatting of the question so its more readable now.

[Lowell]

Still not sure what your are really asking here, but perhaps the following question/answer would be helpful to you. You both seem to be looking at Citrix/MetaFrame POST events:

• search that captures sum of users by url

[Simeon]

I'm still confused. I think you should supply some sample events and clarify exactly what you need to do functionally.

[Lowell]

By "string", do you mean "search string"? Can you provide a sample event or two. I assume your are looking at some kind of http access log? Is this correct? (Please edit your question and provide some additional details.)

[Simeon]

Can you clarify what you want to get the sum of?