topic How to create a search to find the same IP hitting specific URL (x number of times)? in Splunk Search

How to create a search to find the same IP hitting specific URL (x number of times)?

sbhuie — Fri, 21 Jun 2019 20:49:48 GMT

Having trouble creating a search that will determine if any single unique IP hits a defined URL 5 or more times within a 30 minute time frame. I've been trying something like this...

index=*index* sourcetype=*sourcetype* URL="*uriPath*"
| stats dc(*uriPath*) as URL by *srcIP*
| where URL>5

Re: How to create a search to find the same IP hitting specific URL (x number of times)?

niketn — Sun, 23 Jun 2019 12:10:47 GMT

@sbhuie try the following

 index=<index> sourcetype=<sourcetype> URL="<uriPath>"
 | bin _time span=30min
 | stats dc(URL) as URL by _time srcIP
 | where URL>5
 | xyseries _time srcIP URL

Following is run anywhere search example based on Splunk's _internal index

index=_internal sourcetype=splunkd_ui_access
| bin _time span=30min
| stats dc(uri) as Hit by _time  clientip
| search Hit>5
| xyseries _time clientip Hit

Re: How to create a search to find the same IP hitting specific URL (x number of times)?

spayneort — Mon, 24 Jun 2019 15:58:17 GMT

If it is a single uriPath you are looking at, you can do this:

index="<index>" sourcetype="<sourcetype>" URL="<uriPath>" | stats count by srcIP | search count>5