Splunk Search

Count client IP access to Web Server

New Member

Hi All,

I want to count how many IP access to my Web Server in a period ?
I really don't know
Please show me sample : regex and etc ...

Thanks
goldarrow

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

Not sure your question really falls into the area of regex. I'm going to make some assumptions:

  1. You are using Apache or similar webserver that logs in the NCSA-style "combined" log format
  2. You have configured Splunk to index those combined logs and they are being indexed with the proper sourcetype recognition and field extraction is happening as it should

Assuming both of those are true, then what you want should be a simple search in Splunk, something like:

sourcetype=access_combined | timechart dc(src_ip)

If my assumptions are off, you're going to have to clarify some so we can tell where you are.