Hi, I found on this forum the following search : top 10 URL for top 10 Users.
I modify this search to comply with my bluecoat Logs (get top 10 URL (dest_host) for top all organisme):
sourcetype="bcoat_proxysg" filter_result!="DENIED" http_response=200 http_content_type="text/html| eventstats count AS total by organisme | stats count first(total) AS total BY organisme dest_host | sort - count | stats list(count) AS count list(dest_host) AS url first(total) AS total by organisme | sort - total | fields - total | eval url=mvindex(url, 0, 30)| eval count=mvindex(count, 0, 30)g
My problem is that the result is grouped by organisme : Each result line is containing one time the organisme name and the 30 entries for each URL:
I would like to get on each single line every information
Result#1 = organisme 1 URL1
Result#2 = organisme 1 URL2
Result#3 = organisme 1 URL3
Result#4 = organisme 1 URL4
...
Result#X = organisme 2 URL1
Result#X = organisme 2 URL2
Result#X = organisme 2 URL3
Result#X = organisme 2 URL4
...
My aim is to populate a summary indexing on with I will generate Web activity for every organisme each month.
Thanks a lot.
Olivier.
I found my answer. If it can help :
sourcetype="bcoat_proxysg" filter_result!="DENIED" http_response=200 http_content_type="text/html" | top category limit=20 by organisme
So simple that I lose mysefl searching a very dificult querry !
Olivier
I found my answer. If it can help :
sourcetype="bcoat_proxysg" filter_result!="DENIED" http_response=200 http_content_type="text/html" | top category limit=20 by organisme
So simple that I lose mysefl searching a very dificult querry !
Olivier