topic How to detect regular activity from logs. in Getting Data In

How to detect regular activity from logs.

souhei — Thu, 08 Jan 2015 12:51:37 GMT

Hi, splunk community.

I would like to detect regular activity with specific URL (or host) from HTTP Proxy logs.
In detail, for example, To detect specific host or URL which someone regularly request for from many many host. Regardless of how long span the regularly activity occurred.
that is, it may be occurred per an hour, or per a day, or per a month...

I tried some commands like "gentimes", "map", "trendline"..., but none of them solved my problem.

What statement should i write?

Re: How to detect regular activity from logs.

FritzWittwer_ol — Thu, 08 Jan 2015 13:02:15 GMT

Hi souhei,
just a simple approach if regular means same URL, you could use

... |stats  stats count by URL

assuming URL is the field containing the URL

Re: How to detect regular activity from logs.

FritzWittwer_ol — Fri, 09 Jan 2015 07:09:38 GMT

Hi
Just my five Cents, I’d try to use a field extractions so I have http://hogehoge.com in a field Url, and then

…| stats count by Url | sort -count

Would give you a list of the repeated URLs requested.

Fritz

Re: How to detect regular activity from logs.

MuS — Fri, 09 Jan 2015 07:43:47 GMT

and I add my two cents: in addition to the field URL add also a field called action and get POST and GET into this field. This way get not only the URL count but also what kind of action was done against this URL...like this:

... | stats count by URL, action | ...

cheers, MuS

Re: How to detect regular activity from logs.

souhei — Fri, 09 Jan 2015 08:16:24 GMT

Thank you in advance for your best kindness, FritsWittwer, MuS.

but, My view point is not "number" of request, but "regularity" of request...

Re: How to detect regular activity from logs.

MuS — Fri, 09 Jan 2015 08:21:07 GMT

simply add _time and create a nice chart to graph it and you should see want you want:

... | timechart count by URL| ...

... | chart count(action) over _time by URL | ....

Re: How to detect regular activity from logs.

souhei — Fri, 09 Jan 2015 10:12:11 GMT

Thank you for your comment, MuS.

I will try your suggestion.