Dashboards & Visualizations

How to present a dashboard panel with the top 10 url's visited along with the Category and Type from the lookup file?

matthew_foos
Path Finder

Hi All,

My input file is titled cis_urls.csv. The fields in the file are URL, Category, and Type. I have a field in one of my indexes that will match up to the URL in the lookup file. This field is url.

I'm attempting to present a dashboard panel with the top 10 url's visited along with the Category and Type from the lookup file.

Thank you in advance.

0 Karma
1 Solution

elliotproebstel
Champion

Your first step will be to upload the file and create a lookup. Let's say you name the lookup cis_urls.

Then you'll run the search that collects events with urls being visited. I'll refer to that as the base search. You'll add a panel to
your dashboard that is a stats table. The query for this panel will look like this:

base search
| top url
| lookup cis_urls URL as url

View solution in original post

elliotproebstel
Champion

Your first step will be to upload the file and create a lookup. Let's say you name the lookup cis_urls.

Then you'll run the search that collects events with urls being visited. I'll refer to that as the base search. You'll add a panel to
your dashboard that is a stats table. The query for this panel will look like this:

base search
| top url
| lookup cis_urls URL as url

livehybrid
Builder

Hi,
Try this (it might need slight tweaking for your file):

index=yourIndexes [| inputlookup cis_urls.csv | rename URL AS url| table url] | stats count by url |  head 10

Or, you could find the top URLs first (see below) which could be more performant.

0 Karma

matthew_foos
Path Finder

Error in 'top' command: The output count field conflicts with the input field 'count'. Use the 'countfield' option to specify a different name.

0 Karma

livehybrid
Builder

Sorry, long day...should be head
Updated the original one.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...