Splunk Search

How to calculate AVG speed of web requests of specific time range?


I have web logs and I want to define any kind of automatic scripts that analyze web pages or any dump attempt.
Of course, I can do this based on a lot of unique URLs, but I want to try to do it through an abnormal speed.

What fields I have: src_ip, user, url. http_method, session_id, http_user_agent, response_code, url_length, bytes.

Tags (2)
0 Karma

Ultra Champion

There are several ways you could do this.

See if this addresses your needs for a table view

<your search>| bin span=1s _time
| stats count by _time, src_ip

You can change the span value to any time bracket you choose 5s 1m etc.
This will give you totals of the requests made in that window, by the src_ip

If you want a simple visualisation, you could use timechart instead

<your search>| timechart count by src_ip span=5s

Both approaches show the same data in slightly different formats.

If my comment helps, please give it a thumbs up!
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!