Splunk Search

search that captures sum of users by url

Jaci
Splunk Employee
Splunk Employee

I need to add something to the following string (or rewrite it) that captures users sum by url by date. Any help would be appreciated.

host="192.xxx.xxx.xx" Prism http://host1.com:80//Citrix/MetaFrame action="POST"| stats count by user, dest_url

Thank you!

1 Solution

sideview
SplunkTrust
SplunkTrust

sounds like

host="192.xxx.xxx.xx" Prism http://host1.com:80//Citrix/MetaFrame action="POST" | timechart span=1d dc(user) by dest_url

run that over a week's worth of data and it'll give you 7 rows where each row is a particular day, each column across the top is a particular dest_url and the numbers in the cells are the distinct count of 'user' for that day and that dest_url

View solution in original post

sideview
SplunkTrust
SplunkTrust

sounds like

host="192.xxx.xxx.xx" Prism http://host1.com:80//Citrix/MetaFrame action="POST" | timechart span=1d dc(user) by dest_url

run that over a week's worth of data and it'll give you 7 rows where each row is a particular day, each column across the top is a particular dest_url and the numbers in the cells are the distinct count of 'user' for that day and that dest_url

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...