How do you chart unique IP addresses that come through our web servers over time?

[dienel]

I need to chart the number of unique IP addresses through our web servers in 15 minute buckets over time.

using this query:

index="web_access" host="mywebhost1" OR  host="mywebhost2" |timechart span=15m count by dc(clientip)

The resulting chart has counts that are way too high — in the thousands.

And this query...

index="web_access" host="mywebhost1" OR  host="mywebhost2" |stats dc(clientip) as clientip

...gives me a count of ~200 for the same time for the last hour.

[mstjohn_splunk]

Hi @dienel,

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

[KailA]

Hello,

I think it's just a little mistake you made in the first search.
Should be like this i guess

index="web_access" host="mywebhost1" OR host="mywebhost2" 
| timechart span=15m dc(clientip) 

That should give you the number of unique IP adress in 15min buckets.

Kail

[dienel]

using the phrase "| timechart span=15m dc(clientip)" results in "No results found"