How to present a dashboard panel with the top 10 url's visited along with the Category and Type from the lookup file?

[matthew_foos]

Hi All,

My input file is titled cis_urls.csv. The fields in the file are URL, Category, and Type. I have a field in one of my indexes that will match up to the URL in the lookup file. This field is url.

I'm attempting to present a dashboard panel with the top 10 url's visited along with the Category and Type from the lookup file.

Thank you in advance.

[elliotproebstel · Accepted solution]

Your first step will be to upload the file and create a lookup. Let's say you name the lookup cis_urls.

Then you'll run the search that collects events with urls being visited. I'll refer to that as the base search. You'll add a panel to
your dashboard that is a stats table. The query for this panel will look like this:

base search
| top url
| lookup cis_urls URL as url

[livehybrid]

Hi,
Try this (it might need slight tweaking for your file):

index=yourIndexes [| inputlookup cis_urls.csv | rename URL AS url| table url] | stats count by url |  head 10

Or, you could find the top URLs first (see below) which could be more performant.

[matthew_foos]

Error in 'top' command: The output count field conflicts with the input field 'count'. Use the 'countfield' option to specify a different name.

[livehybrid]

Sorry, long day...should be head
Updated the original one.