topic Re: Need to search all request based on IP address in Splunk Search

Need to search all request based on IP address

varshna — Wed, 06 Mar 2019 10:02:39 GMT

I have these pattern in logs and I want to search burst of requests coming from one IP address

For example:

line: 10.196.. - - [06/Mar/2019:09:28:41 +0000] "GET /info/moin_static155a/common/ie7/ie7-overflow.js HTTP/1.1" 404 17

Re: Need to search all request based on IP address

renjith_nair — Tue, 29 Sep 2020 23:34:47 GMT

If you have the IP address as a field in the events, you could search it with fieldname_of_ip="10.196..."
Or you shall extract the IP address from the events using rex and search with it
Or you can search directly in the events with index="your index" TERM(10.196...)

Re: Need to search all request based on IP address

JPaule — Wed, 06 Mar 2019 13:34:11 GMT

index=x IP=10.196.xx.xx | table *

Where IP is column name. That should work unless I'm missing something.

Re: Need to search all request based on IP address

cvssravan — Wed, 06 Mar 2019 20:33:10 GMT

You can search directly like this:

index="your index" "10.196.x.x"

Re: Need to search all request based on IP address

varshna — Fri, 08 Mar 2019 06:05:05 GMT

I am getting hit by different IPs at random times and their pattern is random. This is one of the example. Is there a way to detect the pattern, for ex: sudden burst of requests coming from one IP or sudden increase in 5XX or 4XX.

Re: Need to search all request based on IP address

varshna — Mon, 11 Mar 2019 04:57:03 GMT

Re: Need to search all request based on IP address

renjith_nair — Tue, 12 Mar 2019 03:57:20 GMT

@varshna,

You can count the events per IP and compare it with previous counts and see if there is a sudden increase

For eg. index=your_index earliest=-2h |bucket span=1h _time|stats count by IP,_time

Similarly for 5xx and 4xxx