topic Re: How do you list source IPs that hit only two URLs in WEB source types? in Splunk Search

How do you list source IPs that hit only two URLs in WEB source types?

aamer86 — Tue, 05 Feb 2019 14:51:20 GMT

We have WEB logs, and we need to isolate the source IPs that only (only) hit two URLs.

The fields are:

src for source IP
uri_path for hit URL

Re: How do you list source IPs that hit only two URLs in WEB source types?

ccl0utier — Tue, 05 Feb 2019 14:59:14 GMT

So, something like:

<base search here>
| stats distinct_count(uri_path) as distinct_uri_count by src
| where distinct_uri_count = 2

Re: How do you list source IPs that hit only two URLs in WEB source types?

aamer86 — Tue, 05 Feb 2019 15:06:48 GMT

Thanks but I need to get the list of IPs that hit two URLs
account/XYz and account/ABC

Re: How do you list source IPs that hit only two URLs in WEB source types?

ccl0utier — Tue, 05 Feb 2019 15:27:22 GMT

You can add values(src) to the stats command then?

Or am I misunderstanding completely? Do you mean these URIs only? Specific ones?

Re: How do you list source IPs that hit only two URLs in WEB source types?

aamer86 — Tue, 05 Feb 2019 15:38:59 GMT

sorry I think I should have explained it better

so we need to get all the IPs that ONLY hit two urls

account/logon
member/savedcard

As this has been detected as an attack pattern

So i need the IPs that hit only these two URLs

Re: How do you list source IPs that hit only two URLs in WEB source types?

ccl0utier — Tue, 05 Feb 2019 16:23:54 GMT

Then this should do it:

<base search>
| stats values(uri_path) as uri_path by src
| where mvcount(uri_path) = 2 AND isnotnull(mvfind(uri_path, "^account\/logon$")) AND isnotnull(mvfind(uri_path, "^member\/savedcard"))
| stats count by src

You can substitute stats with tstats if uri_path is an indexed field. YMMV.

Re: How do you list source IPs that hit only two URLs in WEB source types?

aamer86 — Tue, 05 Feb 2019 16:50:19 GMT

Thanks but this is really slow search using transaction

can we have something to be used with tstats and Data Model

Re: How do you list source IPs that hit only two URLs in WEB source types?

ccl0utier — Tue, 05 Feb 2019 18:17:44 GMT

I've updated my answer to reflect that. Should be faster/more flexible.

Re: How do you list source IPs that hit only two URLs in WEB source types?

woodcock — Tue, 05 Feb 2019 20:58:28 GMT

Try this:

| tstats count FROM datamodel=Web WHERE index=* AND (Web.url="first/url" OR Web.url="second/url") BY Web.src