topic Re: Basic query for detecting Multiple HTTP errors from unique IP in Splunk Search

What is the basic search for detecting Multiple HTTP errors from unique IP?

mohsplunking — Thu, 14 Sep 2023 20:08:57 GMT

Hello Splunkers,

Can someone help me with a query to detect multiple http errors from single IP , basically when the status code is in 400s/500s.

Thank you,

regards,

Moh

Re: Basic query for detecting Multiple HTTP errors from unique IP

bowesmana — Wed, 13 Sep 2023 23:16:03 GMT

Basic query is something like this, but will depend on your fields

index=your_source_index status>=400 status<600 | stats count by ip status

You will then get a table of ip+status+count

you can do whatever you want to do with that - what's your goal?

Re: Basic query for detecting Multiple HTTP errors from unique IP

mohsplunking — Thu, 14 Sep 2023 08:02:33 GMT

Thanks for your response, the goal is to list the IP's that is causing maximum http errors. Lets say where errors are >100.

Re: Basic query for detecting Multiple HTTP errors from unique IP

gcusello — Thu, 14 Sep 2023 08:26:40 GMT

Hi @mohsplunking,

if you need the total count of errors, the solution from @bowesmana is perfect.

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

Re: Basic query for detecting Multiple HTTP errors from unique IP

mohsplunking — Thu, 14 Sep 2023 08:35:09 GMT

Hello gcusello,

Thanks for your inputs, However, like I said the use case is I'm looking for IP that is causing maximum number of http errors(400s,500s) , lets say I'm trying to find a single IP that is causing over 100 http errors . I think in the query we will have to use eval&case functions too.

Please let me know if you need further clarifications on the above.

Moh.

Re: Basic query for detecting Multiple HTTP errors from unique IP

bowesmana — Fri, 15 Sep 2023 00:12:08 GMT

@mohsplunking

index=your_source_index status>=400 status<600 | stats count by ip | where count>100

or you can do

index=your_source_index status>=400 status<600 | top ip | where count > 100

but I would prefer stats over top

Re: Basic query for detecting Multiple HTTP errors from unique IP

gcusello — Fri, 15 Sep 2023 06:02:54 GMT

i @mohsplunking ,

if you ne only an alert, as I said, the solution from @bowesmana is perferct and you don't need any additional command.

the eval/case could be useful if you need to display some additional information e.g. a level of alert quantity.

Ciao.

Giuseppe