Newbie to splunk, but I want to aggregate the log entries below based upon if it's the same ip address and request url.
192.168.8.5 [10/Nov/2011:11:11:23] "GET /hello/world HTTP/1.1" 200 1234 192.168.8.7 [10/Nov/2011:15:46:23] "GET /foo/bar HTTP/1.1" 200 124 192.168.8.5 [10/Nov/2011:18:00:25] "GET /foo/bar HTTP/1.1" 200 124 192.168.8.10 [10/Nov/2011:23:11:23] "GET /hello/world HTTP/1.1" 200 1234 192.168.8.5 [10/Nov/2011:23:59:00] "GET /hello/world HTTP/1.1" 200 1234
So the outcome I would like is as follows:
ip address request url count 192.168.8.5 "GET /hello/world HTTP/1.1" 2 192.168.8.7 "GET /foo/bar HTTP/1.1" 1 192.168.8.5 "GET /foo/bar HTTP/1.1" 1 192.168.8.10 "GET /hello/world HTTP/1.1" 1
Can someone provide some insight? I've played around with dedup and distinct_count but can't seem to get it right to get the aggregated information from splunk.
Thanks in advance.
Hi,
Given that you have extracted the fields as clientip
and url
<your base search here> | stats count by clientip url
should produce the desired results.
hope this helps,
/Kristian
just search ... | stats count by ip_address,request_url can do for this