topic Re: How to generate a search to find unique IPs hitting a specific URL in Specific Time Range? in Splunk Search

How to generate a search to find unique IPs hitting a specific URL in Specific Time Range?

mistydennis — Tue, 28 Feb 2017 22:29:02 GMT

Hello - I'm trying to write a search string that finds unique IPs hitting a specific URL in 30 minute bursts. For example, if src_ip 123456.00 hits "www.foo.com" five times in a 30 minute period, I only want it to count as one hit.

How is this done?

Re: How to generate a search to find unique IPs hitting a specific URL in Specific Time Range?

somesoni2 — Tue, 28 Feb 2017 22:32:32 GMT

Without much info to go on, try something like this

index=foo sourcetype=bar "www.foo.com"| stats count by src_ip | table src_ip

Re: How to generate a search to find unique IPs hitting a specific URL in Specific Time Range?

mistydennis — Tue, 28 Feb 2017 22:43:01 GMT

So that will find the unique IPs, but what I'm struggling with is applying the 30 minute time filter to them. So if my url gets hit 100 times in 30 minutes by the same unique IP, I don't want the 100 hits to apply towards my count. I only want it to act as 1 hit.

Re: How to generate a search to find unique IPs hitting a specific URL in Specific Time Range?

DalJeanis — Tue, 28 Feb 2017 22:47:11 GMT

if you want fixed 30 minute periods -

 index=foo sourcetype=bar "www.foo.com"| bin _time span=30m | stats count by _time src_ip | table _time  src_ip

if you want floating 30m periods, and for example want to count events that are more than 15m apart as separate

 index=foo sourcetype=bar "www.foo.com"| transaction src_ip maxspan=30m maxpause=15m keeporphans=true

With either one of those, you are then going to drop the result into something like

| stats count by src_ip

Re: How to generate a search to find unique IPs hitting a specific URL in Specific Time Range?

woodcock — Wed, 01 Mar 2017 19:22:21 GMT

Like this:

index=foo sourcetype=bar "www.foo.com"| dedup src_ip | table src_ip

Re: How to generate a search to find unique IPs hitting a specific URL in Specific Time Range?

mistydennis — Wed, 01 Mar 2017 19:35:58 GMT

Thanks, DalJeanis - this is what I was looking for!

Re: How to generate a search to find unique IPs hitting a specific URL in Specific Time Range?

DalJeanis — Wed, 01 Mar 2017 21:21:28 GMT

Glad to help.