topic Re: How do you chart unique IP addresses that come through our web servers over time? in Dashboards & Visualizations

How do you chart unique IP addresses that come through our web servers over time?

dienel — Mon, 05 Nov 2018 23:00:06 GMT

I need to chart the number of unique IP addresses through our web servers in 15 minute buckets over time.

using this query:

index="web_access" host="mywebhost1" OR  host="mywebhost2" |timechart span=15m count by dc(clientip)

The resulting chart has counts that are way too high — in the thousands.

And this query...

index="web_access" host="mywebhost1" OR  host="mywebhost2" |stats dc(clientip) as clientip

...gives me a count of ~200 for the same time for the last hour.

Re: How do you chart unique IP addresses that come through our web servers over time?

KailA — Mon, 05 Nov 2018 23:40:44 GMT

Hello,

I think it's just a little mistake you made in the first search.
Should be like this i guess

index="web_access" host="mywebhost1" OR host="mywebhost2" 
| timechart span=15m dc(clientip)

That should give you the number of unique IP adress in 15min buckets.

Kail

Re: How do you chart unique IP addresses that come through our web servers over time?

mstjohn_splunk — Tue, 06 Nov 2018 22:33:32 GMT

Hi @dienel,

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

Re: How do you chart unique IP addresses that come through our web servers over time?

dienel — Wed, 07 Nov 2018 14:33:48 GMT

using the phrase "| timechart span=15m dc(clientip)" results in "No results found"