Splunk Search

how to aggregate log entries

New Member

Newbie to splunk, but I want to aggregate the log entries below based upon if it's the same ip address and request url.     [10/Nov/2011:11:11:23] "GET /hello/world HTTP/1.1" 200 1234     [10/Nov/2011:15:46:23] "GET /foo/bar HTTP/1.1" 200 124     [10/Nov/2011:18:00:25] "GET /foo/bar HTTP/1.1" 200 124    [10/Nov/2011:23:11:23] "GET /hello/world HTTP/1.1" 200 1234     [10/Nov/2011:23:59:00] "GET /hello/world HTTP/1.1" 200 1234

So the outcome I would like is as follows:

ip address      request url                     count     "GET /hello/world HTTP/1.1"     2     "GET /foo/bar HTTP/1.1"         1     "GET /foo/bar HTTP/1.1"         1    "GET /hello/world HTTP/1.1"     1

Can someone provide some insight? I've played around with dedup and distinct_count but can't seem to get it right to get the aggregated information from splunk.

Thanks in advance.

Tags (1)
0 Karma

Ultra Champion


Given that you have extracted the fields as clientip and url

   <your base search here> | stats count by clientip url

should produce the desired results.

hope this helps,



just search ... | stats count by ip_address,request_url can do for this

0 Karma