Hi Somesoni, Thank you for your response. So I have made some progress on this thankfully, the search is now looking like this: index=proxy OR index=web gateway src_country="country" | rex "\/\/(?:[^@\/\n]+@)?(?:www\.)?(?<url>[^:\/\n]+)" | search ([|inputlookup users.csv]) | stats count as Total by url | sort 0 - "Total" The results are laid out perfectly with the count and top level domains, but I'm are getting a lot of URLs like, 'google.com', 'youtube.com' etc, which is obviously usual traffic. I'm now looking into getting the top 1m alexa domains added to the search so we can exclude all the known URLs. Would this type of search be possible? We will have 2 inputlookups in one search, 1 searching a specific user set and the other to exclude known domains. How could I implement that into the search query? Also, would it be possible to have an email sent with an attachment showing the 20 least communicated URLs? Our current alert doesn't seem to be working: Alert Type: Real Time Expires: 72 hours Trigger when: Number of results, is equal to 20, in 60min Trigger: Once Throttle: 58min Action: send an email with .csv attachment Thanks, Mark Nicholls
... View more
