Getting Data In

IIS Logs - Query to report on file downloads

JoshuaThompson
New Member

Hello,

I am currently using a trial version of Splunk 6.1 Enterprise. I am looking for a query that will create a report that shows a count of how many times files from our website were downloaded over a given period. There are about 10 different files names I need to report on.

All file downloads will be PDFs. All IIS logs are indexed in Splunk under "Files and Directories". The logs are in the IIS format (not W3C) and Splunk does not appear to be recognizing the "target" field.

Here is my query:
*.PDF "\\UNC PATH TO SERVER LOGS\*"

I get results with this query that shows the PDF access but I am unsure what to do next to get the information I need.

Tags (1)
0 Karma

lguinn2
Legend

Try this:

.pdf get
| rex "GET,\s+(?<fileName>\S+.pdf),"
| stats count by fileName
0 Karma

JoshuaThompson
New Member

That is exactly what I am looking for. Thank you.

0 Karma

lguinn2
Legend

.pdf get NOT (xx.xx.xx.xx OR xx.xx.xx.xx) NOT ("file4.pdf" OR "file5.pdf")
| rex "GET,\s+(?\S+.pdf),"
| stats count by fileName

will probably work!

0 Karma

JoshuaThompson
New Member

Perfect! Thanks. I also need to be able to exclude certain IP Addresses and certain PDF file names. Is this possible?

0 Karma

JoshuaThompson
New Member

Thank you for your help. Attached is sample output from my above query. Other results are similar except for date/time and the PDF file name. I cannot upload a screen shot at this time.

Output:
87.234.63.90, -, 5/21/2014, 0:45:24, W3SVC3, xxxxxxxxx, xx.xx.xx.xx, 2062, 604, 240268, 200, 0, GET, /perspectives/MarketPerspectives_2014_4.pdf, -,

date_hour = 22
date_mday = 21
date_minute = 55
date_month = may
eventtype = wineventlog-index eventtype = winevents
host = xxxxxxxxx
index = main
source = \xxxxxxxxx\u_in14052100.log
sourcetype = u_in

0 Karma

somesoni2
Revered Legend

Can you post some sample events (output of your query) and the expected report format? You may have to setup some field-extractions and then run the necessary reporting command to generate expected output.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...