Hi fellow Splunkers!
I'm hoping you can help my manager and I with a certain problem we're trying to solve. We have an internal system that's used by a number of employees and we're trying to find the pages that exist but employees never use.
You may already see the predicament we're running into -- When running a query with the 'rare' function, we're getting page hits that have a value of at least 1 -- as there's no log that's generated when a page is not accessed. We're looking for page hits with a value of 0.
We've thought about running a script periodically that accesses every page, therefore any value that has 1 would actually be 0. Though we don't want to do this as we're a large company and there's other organizations that very well could be thrown off by this fake data.
The best idea my manager and I have come with is finding a way to upload a table of every page that's available and comparing the logs with that table in Splunk. He and I are both novices with Splunk and don't know if this is actually possible, however. Splunk may not be the right tool for this task but we'd prefer to do it in Splunk so we can start generated regular reports on these pages that don't get accessed month over month.
Any insight you all may be able to provide would be amazing!
... View more