Splunk Search

how to aggregate log entries

mchan
New Member

Newbie to splunk, but I want to aggregate the log entries below based upon if it's the same ip address and request url.

192.168.8.5     [10/Nov/2011:11:11:23] "GET /hello/world HTTP/1.1" 200 1234
192.168.8.7     [10/Nov/2011:15:46:23] "GET /foo/bar HTTP/1.1" 200 124
192.168.8.5     [10/Nov/2011:18:00:25] "GET /foo/bar HTTP/1.1" 200 124
192.168.8.10    [10/Nov/2011:23:11:23] "GET /hello/world HTTP/1.1" 200 1234
192.168.8.5     [10/Nov/2011:23:59:00] "GET /hello/world HTTP/1.1" 200 1234

So the outcome I would like is as follows:

ip address      request url                     count      
192.168.8.5     "GET /hello/world HTTP/1.1"     2 
192.168.8.7     "GET /foo/bar HTTP/1.1"         1
192.168.8.5     "GET /foo/bar HTTP/1.1"         1
192.168.8.10    "GET /hello/world HTTP/1.1"     1

Can someone provide some insight? I've played around with dedup and distinct_count but can't seem to get it right to get the aggregated information from splunk.

Thanks in advance.

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

Hi,

Given that you have extracted the fields as clientip and url

   <your base search here> | stats count by clientip url

should produce the desired results.

hope this helps,

/Kristian

hjwang
Contributor

just search ... | stats count by ip_address,request_url can do for this

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...