Splunk Search

common among all users

mcbradford
Contributor

I have been asked to identify a list of all websites that a group of users has visited, but the spin on it is that each user must have visited the same website.

For example; user a, b, and c visits google.com, but user d does not, then google would not be in the results. If user a, b, c and d visits abc.com, then abc would be in the results.

Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this.

Assuming you have search which returns list of USER and WEBSITE used by user.

your base search returning USER and WEBSITE | table USER, WEBSITE | eventstats dc(USER) as TotalUsers | stats count by WEBSITE, TotalUsers | where count=TotalUsers

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this.

Assuming you have search which returns list of USER and WEBSITE used by user.

your base search returning USER and WEBSITE | table USER, WEBSITE | eventstats dc(USER) as TotalUsers | stats count by WEBSITE, TotalUsers | where count=TotalUsers
0 Karma

mcbradford
Contributor

Worked perfect - thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...