Splunk Enterprise

Check what URLs are called

cramery
New Member

New to Splunk, so a bit of a basic question

I need to have a list of all URLs that are called by the User on the PC Splunk is running on. It doesnt matter if all URLs or called by a specific application. How can I implement this to Splunk?

Tags (3)
0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

If you have data in an index such as weblogs, you would do a search such as
index=weblogs sourcetype=access_combined OR sourcetype=iis | eval full_path=uri_domain.uri_path| stats values(full_path) by user

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

Are you referring to Splunk URLs? For example, https://localhost:8000/en-US/app/search/search and https://localhost:8000/en-US/app/search/search?q=search%20index%3D*&sid=1552910209.54&display.page.s...

If so, you can run a query such as
index=_internal sourcetype=splunk_web_access | stats count by uri

0 Karma

cramery
New Member

I'm trying to get a list in Splunk when, which user called what URL ond any Website (like google.com in Google Chrome), same way as I can see all Applications called by the user.

0 Karma

niketn
Legend

Do you mean URLs internal to Splunk or a client/server with Splunk Forwarder which is trying to access external URLs?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

cramery
New Member

Actually I'm just trying to get a list in Splunk when, which user called what URL ond any Website (like google.com in Google Chrome), same way as I can see all Applications called by the user

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...