topic IIS Logs - Query to report on file downloads in Getting Data In

IIS Logs - Query to report on file downloads

JoshuaThompson — Wed, 28 May 2014 17:27:08 GMT

Hello,

I am currently using a trial version of Splunk 6.1 Enterprise. I am looking for a query that will create a report that shows a count of how many times files from our website were downloaded over a given period. There are about 10 different files names I need to report on.

All file downloads will be PDFs. All IIS logs are indexed in Splunk under "Files and Directories". The logs are in the IIS format (not W3C) and Splunk does not appear to be recognizing the "target" field.

Here is my query:
*.PDF "\\UNC PATH TO SERVER LOGS\*"

I get results with this query that shows the PDF access but I am unsure what to do next to get the information I need.

Re: IIS Logs - Query to report on file downloads

somesoni2 — Wed, 28 May 2014 20:09:42 GMT

Can you post some sample events (output of your query) and the expected report format? You may have to setup some field-extractions and then run the necessary reporting command to generate expected output.

Re: IIS Logs - Query to report on file downloads

JoshuaThompson — Mon, 28 Sep 2020 16:44:48 GMT

Thank you for your help. Attached is sample output from my above query. Other results are similar except for date/time and the PDF file name. I cannot upload a screen shot at this time.

Output:
87.234.63.90, -, 5/21/2014, 0:45:24, W3SVC3, xxxxxxxxx, xx.xx.xx.xx, 2062, 604, 240268, 200, 0, GET, /perspectives/MarketPerspectives_2014_4.pdf, -,

date_hour = 22
date_mday = 21
date_minute = 55
date_month = may
eventtype = wineventlog-index eventtype = winevents
host = xxxxxxxxx
index = main
source = \xxxxxxxxx\u_in14052100.log
sourcetype = u_in

Re: IIS Logs - Query to report on file downloads

lguinn2 — Thu, 29 May 2014 04:27:12 GMT

Try this:

.pdf get
| rex "GET,\s+(?<fileName>\S+.pdf),"
| stats count by fileName

Re: IIS Logs - Query to report on file downloads

JoshuaThompson — Thu, 29 May 2014 14:00:21 GMT

Perfect! Thanks. I also need to be able to exclude certain IP Addresses and certain PDF file names. Is this possible?

Re: IIS Logs - Query to report on file downloads

lguinn2 — Thu, 29 May 2014 23:01:40 GMT

.pdf get NOT (xx.xx.xx.xx OR xx.xx.xx.xx) NOT ("file4.pdf" OR "file5.pdf")
| rex "GET,\s+(?\S+.pdf),"
| stats count by fileName

will probably work!

Re: IIS Logs - Query to report on file downloads

JoshuaThompson — Mon, 02 Jun 2014 17:53:39 GMT

That is exactly what I am looking for. Thank you.