Hi!
I have spent a couple of days now hunting for an answer with similar issues, but I am no closer to finding a solution. The gist of it is that each org has several case files, and multiple documents within each case. I am trying to track the user accounts to see the volume of documents they are accessing.
The information is kept in two separate log files: the user log output in userlog; and the request log accessible through access_combined. The request log doesn't store the user ID and the userlog doesn't store the document access, only the reference page with links. I have managed to get all the data I need, I just cannot get it to display correctly. The code I have so far to get the data is:
sourcetype=userlog page='/cases/case_docs' userid=$userid$ earliest=-24h
| rex field=url "(?<matchORG>J\d{6}J),(?<caseID>\d{5}\w{1,2})," max_match=0
| rex field=WebServiceHost "host=\'(?<host>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})\'"
| lookup orgName.csv ORGCODE as matchORG OUTPUT NAME
| rename NAME as orgName
| fields host userid orgName matchORG caseID
| eval clientip = host
| join clientip max=0
[search sourcetype=access_combined earliest=-24h
| fields file clientip CASE_ID ORG_ID accessTime uri_path
| where like(file,"%.pdf")
| where like(uri_path,"%/service/document/%")
]
| where match(CASE_ID,caseID)
The fields...
file
uri_path
CASE_ID
ORG_ID
...are already predefined, extracted, and captured by Splunk.
Where I am hitting a dead end is attempting to show the number of documents access by case file, and the overall documents accessed by organization. My desire is to have it show up as the Org Name, total document count, case ID, document count per case ID. Something like the image below:
(Note: There is a typo in the table. JxxxxxxJ should instead be OrgA, OrgB, etc.)
I have looked at options from other similar posts, but I just can't seem to get them work. And the one close to working, modifying the answer on a different similar question, only gives me partial results (but they all appear in the events tab):
| stats count by orgName caseID
| stats values(caseID) as Cases values(count) as CaseCount sum(count) as Total by orgName
If anyone can point me in the right direction, it would be greatly appreciated. Also, any tips on streamlining this code would be appreciated as well.
Addendum: Stuck at Splunk Enterprise 6.1.2 for...reasons.
... View more