Follow these steps to search for the most accessed web pages:
- Log in to your Splunk server.
- Select the Search & Reporting application.
- Set the range picker to Last 24 hours and type the following search into the Splunk search bar. Then, click on Search or hit Enter:
index=main sourcetype=access_combined | stats count by uri_path | sort - count
- Splunk will return a list of pages, and a new field named count displays the total number of times the page has been accessed, as shown in the following screenshot:
- Save this search by clicking on Save As and then on Report. Give the report a name of cp02_most_accessed_webpages
