IIS Logs - Query to report on file downloads

[JoshuaThompson]

Hello,

I am currently using a trial version of Splunk 6.1 Enterprise. I am looking for a query that will create a report that shows a count of how many times files from our website were downloaded over a given period. There are about 10 different files names I need to report on.

All file downloads will be PDFs. All IIS logs are indexed in Splunk under "Files and Directories". The logs are in the IIS format (not W3C) and Splunk does not appear to be recognizing the "target" field.

Here is my query:
*.PDF "\\UNC PATH TO SERVER LOGS\*"

I get results with this query that shows the PDF access but I am unsure what to do next to get the information I need.

[lguinn2]

Try this:

.pdf get
| rex "GET,\s+(?<fileName>\S+.pdf),"
| stats count by fileName

[JoshuaThompson]

That is exactly what I am looking for. Thank you.

[lguinn2]

.pdf get NOT (xx.xx.xx.xx OR xx.xx.xx.xx) NOT ("file4.pdf" OR "file5.pdf")
| rex "GET,\s+(?\S+.pdf),"
| stats count by fileName

will probably work!

[JoshuaThompson]

Perfect! Thanks. I also need to be able to exclude certain IP Addresses and certain PDF file names. Is this possible?

[JoshuaThompson]

Thank you for your help. Attached is sample output from my above query. Other results are similar except for date/time and the PDF file name. I cannot upload a screen shot at this time.

Output:
87.234.63.90, -, 5/21/2014, 0:45:24, W3SVC3, xxxxxxxxx, xx.xx.xx.xx, 2062, 604, 240268, 200, 0, GET, /perspectives/MarketPerspectives_2014_4.pdf, -,

date_hour = 22
date_mday = 21
date_minute = 55
date_month = may
eventtype = wineventlog-index eventtype = winevents
host = xxxxxxxxx
index = main
source = \xxxxxxxxx\u_in14052100.log
sourcetype = u_in

[somesoni2]

Can you post some sample events (output of your query) and the expected report format? You may have to setup some field-extractions and then run the necessary reporting command to generate expected output.