Searching for the most accessed pages by user

We can modify the search from this recipe and can use the distinct count (dc) function of the stats command to display a list of users and the unique pages they visited:

sourcetype=access_combined index=main | stats dc(uri_path) by user | sort - user 

The distinct count function ensures that if a user visits the same page multiple times, it is only counted as one visit. The user who visited the most number of unique pages will be at the top of the list, as we used a descending sort.

For more information on the various functions that can be used with the stats command, please check out https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions.