If you are looking for an output that looks like this:
Dopey 15 snowwhite.com
10 evilqueen.com
Sneezy 20 evilqueen.com
...and you want the inner lists of URL's sorted in descending order, then you want the list sorted in descending order by total URL hits for a user, your search would look like this:
index="websense_events" category_name="*" sourcetype=websense_incoming user_login_name="*" ou_name="*OU=*" | eventstats count AS total by user_login_name | stats count first(total) AS total BY user_login_name tld | sort - count | stats list(count) AS count list(tld) AS url first(total) AS total by user_login_name | sort - total | fields - total | head 10 | eval url=mvindex(url, 0, 9) | eval count=mvindex(count, 0, 9)
This assumes that your URL field is 'tld'. This should provide a sorted Top 10 URL's per user with individual hit count, as well as a sorted list by total counts for each user, also filtered to show only the Top 10 Users by Total.
Cheers,
Ron
... View more