Splunk Search

Looking for a way to display sub items, kind of like pivot table in Excel.

oleg106
Explorer

Hi, I am looking to display results a certain way and want to know if this is possible in Splunk. We have proxy logs that contain URLs and client IPs. I want to group by URLs (top 20) and display all IPs that connected to them. I want the output to look something like this,,

Url CountOfConnections

..Client IP list

google.com 3

...192.168.1.2

...192.168.1.7

...192.168.1.3

yahoo.com 2

...192.168.1.2

...192.168.1.3

Basically a visually simple way to distinguish urls and clients.

Doing something like "top 20 url ip" doesn't look good for this type of report. Thanks!

Tags (2)
0 Karma

BobM
Builder

would this be what you want?

| stats values(ip) as IPs by url
0 Karma

BobM
Builder

so add another function.

| stats values(ip) as IPs dc(ip) as ipCount by url | sort - ipCount

0 Karma

oleg106
Explorer

Thanks, but that's no quite it. I already tried it before. It doesn't give me a count for each site, and also I can't figure out a way to sort it by # of IPs per url.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...