topic Re: Is it possible to query IIS logs for a monthly web application hit count for multiple web applications on a domain? in Splunk Search

Is it possible to query IIS logs for a monthly web application hit count for multiple web applications on a domain?

jasonmhamilton — Thu, 20 Jan 2022 23:29:15 GMT

Hello,

I was wondering if it is possible to use Splunk to query IIS logs for a monthly application hit count for multiple web applications on the same domain?

The report I need to submit would look something like:
http://domain/webapp1/ - ## total monthly hits
http://domain/webapp2/ - ## total monthly hits
....

I just need the overall total monthly hit count and not the total unique IP address hit count.

Any help would be much appreciated. Thank you!

Re: Is it possible to query IIS logs for a monthly web application hit count for multiple web applications on a domain?

Chef — Fri, 21 Jan 2022 00:46:53 GMT

The easiest way would be to just run two separate searches to get your counts:

index=iis_index url=http://domain/webapp1/* | stats count index=iis_index url=http://domain/webapp2/* | stats count

And just change your time period to be for the month.

If you wanted to do it in one search, you could do something like the following:

index=iis_index url=http://domain/webapp1/* OR url=http://domain/webapp2/* | rex "http://domain/(?<webapp>[^/]+" | stats count by webapp

This second search will extract a new field named webapp which you will be able to use in stats functions.

Re: Is it possible to query IIS logs for a monthly web application hit count for multiple web applications on a domain?

jasonmhamilton — Fri, 21 Jan 2022 01:49:02 GMT

I'm a Splunk newbie. How do I specify the timespan to a month and specify which month or start and end date/time for the query?

I currently use a LogParser query on the IIS logs to do this and wrote a script that I call with just the start and end date and time as variables (e.g "2022-01-01 00:00:00" "2022-01-31 23:59:59" as the start/end date and time). That method will not be an option much longer so I am looking to use Splunk for a new way of gathering these monthly metrics.

Re: Is it possible to query IIS logs for a monthly web application hit count for multiple web applications on a domain?

Chef — Fri, 21 Jan 2022 05:45:03 GMT

When you ingest these logs into Splunk, it will detect the timestamp from the logs and store them accordingly.

So when you write a Splunk search, you will have the option of what timeframe you wish to search - you can see more details here:
https://docs.splunk.com/Documentation/Splunk/8.2.4/Search/Selecttimerangestoapply

There's a lot of preset time criteria you can use such as "Previous Month" and you can even select specific time and date ranges too.