Skip to main content
Ian_Harrison
Ian_Harrison
New Member
December 11, 2015
Question

Custom report to list defined keywords that users have searched for

  • December 11, 2015
  • 2 replies
  • 4072 views

Hi

 

I need some help in defining a report that I can define a number of keywords in (or pass to) and then to list those keywords and which users used them in searches.  I can run a report to list the top x number of keywords and this works fine so I know they are been logged ok.

 

Thanks for any help.

 

Ian

    2 replies

    Ian_Harrison
    Ian_HarrisonAuthor
    New Member
    December 11, 2015

    Hi

     

    So I have tried the following code, has anyone got anything better:

     

    select from_itime(itime) as timestamp, keyword, srcip, coalesce( nullifna(`user`), ipstr(`srcip`) ) as user_src, count(*) as requests from $log where $filter and keyword = 'google' or keyword = 'london' group by keyword, timestamp, srcip, user_src order by timestamp

    hzhao_FTNT
    Staff
    hzhao_FTNT
    Staff
    December 15, 2015

    Hi there, your dataset looks OK. But if you need count(*), please removed timestamp in your query.

     

    hz

    Terms & ConditionsAccessibility statement
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!