运维利器:WEB日志分析场景介绍( 二 )

secsoso 'access.log $7="*.html*" |stats $1 as ip,count($1) as count by $1'stats $1 as ip,count($1) as count by $1 和 stats count($1) by $1 结果一样,只是前者可以从新命名,命名也可以放在后面做:
stats count($1) by $1|rename $1 as ip,结果如下:
ip count10.70.101.89 310.70.101.90 310.70.141.32 310.70.142.18 510.70.146.115 210.70.146.120 510.70.147.28 210.70.149.233 2 
查看每一个IP访问了多少个页面按从大到小排序secsoso 'access.log $7="*.html*" |stats $1 as ip,count($1) as count by $1|sort -count'结果如下:
ip count10.74.52.51 2110.80.189.69 1210.71.37.20 910.77.6.9 910.71.48.20 910.80.6.121 810.77.7.244 8 
查看某一个IP访问了哪些页面secsoso 'access.log "10.74.52.51" $7="*.html*" |fields $1,$7'

$7="*.html*"也支持正则表达式需要用//包起来,比如”access.log” “10.74.52.51” $7=”/.


推荐阅读