Hello all, I need a hand with a basic Splunk search. I appreciate this is Splunk 101 basics, but with other commitments, I am struggling to remember all commands.  What I need is to edit the following search, (or someone kind enough to completely improve the search), that rather the showing the same day next to each URL in the field "day", it just shows all URLs next to one single entry of the day. hopefully, that makes sense? index=netproxy user=(user) (url=https://www* OR url=http://www.) | stats count by day, url day                                    url                                                                   count Mon, 13 Dec 2021    https://www.bizographics.com/         1 Mon, 13 Dec 2021 https://www.bleacherbreaker.com/     2788 Mon, 13 Dec 2021 https://www.google-analytics.com/     3 Mon, 13 Dec 2021 https://www.google.co.uk/                       5                     Mon, 13 Dec 2021 https://www.googletagmanager.com/ 10 Mon, 13 Dec 2021 https://www.googletagservices.com/  6 Sat, 11 Dec 2021 https://www.capitalfm.com/                     23 Sat, 11 Dec 2021 https://www.capitalxtra.com/                   26 Sat, 11 Dec 2021 https://www.globalplayer.com/                 8   Basically what I am after is a search that shows,  -    day                                             url                                            times visited(count) Mon, 13 Dec 2021    https://www.bizographics.com/            1                                           https://www.bleacherbreaker.com/      2788                                           https://www.google-analytics.com/      3                                           https://www.google.co.uk/                         5                                           https://www.googletagmanager.com/   10                                           https://www.googletagservices.com/   5 If anyone can improve on my basic search it would be greatly appreciated ... View more

Hello all, I do appreciate this question has been asked several times, but I am struggling to understand how to link searches together.  I have search A that highlights what src_ip communicated with dest_ip on a specific port-  (index=netfw OR index=netproxy) AND ("192.168.*.*") AND (dest_port="23") | table src_ip, dest_ip, dest_port, _time I then take the results from the src_ip and link it to the second search in a new tab to find the computer hostname from the src_ip via DHCP logs -  index=oswinsec sourcetype=dhcp ip=192.168.*.* | table ip, dest, date, time Is it at all possible to combine these so when I do a search on a specific destination IP, the results src_ip is converted into the hostnames found in the DHCP source type? thank you ... View more