Report of sites visited by user (squid)

Question

I have Splunk on both of my Squid proxies forwarding the access.log to our main Splunk installation. How would I create a report of distinct domains visited by user?

Accepted Answer

1

You should be able to do something like this:

host=squid* source=*access.log | stats count by domain, user

Or another possible grouping would be like:

host=squid* source=*access.log | stats count, values(domain) as domains by user

link

answered 02 Jun '10, 21:13

Lowell ♦
9.6k●6●37
accept rate: 40%

Report of sites visited by user (squid)

Follow this question

Splunk Resources

Related questions