How to do it...

Follow these steps to search for the most accessed web pages:

1. Log in to your Splunk server.
2. Select the Search & Reporting application.
3. Set the range picker to Last 24 hours and type the following search into the Splunk search bar. Then, click on Search or hit Enter:

index=main sourcetype=access_combined | stats count by uri_path | sort - count

1. Splunk will return a list of pages, and a new field named count displays the total number of times the page has been accessed, as shown in the following screenshot:

1. Save this search by clicking on Save As and then on Report. Give the report a name of cp02_most_accessed_webpages and click on Save. On the next screen, click on Continue Editing to return to the search.