Splunk Search

How to find the RequestPerSec by Country using ClientIP adddress ?

sangs8788
Communicator

Hi

I have a query which would list me avg, max & P95 requestpersec for the selected time range

  index=test  client_ipaddress=* |eval requestcount=1 | timechart per_second(requestcount) AS RequestPerSec
     | eventstats max(RequestPerSec) as peakRequestPerSec
     | eval peakTime=if(peakRequestPerSec==RequestPerSec,_time,null())
     | timechart span=1m avg(RequestPerSec) as avgRequestPerSec max(RequestPerSec) as peakRequestPerSec p95(RequestPerSec) as p95RequestPerSec
     | fieldformat peakTime=strftime(peakTime,"%m/%y %H:%M") | eval avgRequestPerSec=round(avgRequestPerSec,2) | eval peakRequestPerSec=round(peakRequestPerSec,2)| eval p95RequestPerSec=round(p95RequestPerSec,2)|rename avgRequestPerSec as "Average Requests/Sec" peakRequestPerSec as "Max Requests/Sec" p95RequestPerSec as "P95 Requests/Sec"

The question here is, Can i show Requestpersec by country using the field client_ipaddress present in the events ? How do i do that ? Please let me know

Tags (1)
0 Karma
1 Solution

renjith_nair
Legend

@sangs8788,

You could use iplocation command for that.
E.g.

index=test  client_ipaddress=* |iplocation client_ipaddress|fields requestcount,Country|eval requestcount=1 | timechart per_second(requestcount) AS RequestPerSec by Country
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@sangs8788,

You could use iplocation command for that.
E.g.

index=test  client_ipaddress=* |iplocation client_ipaddress|fields requestcount,Country|eval requestcount=1 | timechart per_second(requestcount) AS RequestPerSec by Country
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

sangs8788
Communicator

@renjith.nair This would work to display by Country. Thanks. But Is it possible to display using Chart command ?

index=data | eval wall_time = round(wall_time/1000,2) | eval Latency=case(wall_time<500, "0-0.5s", wall_time>=500 AND wall_time<1000, "0.5s-1s",wall_time>=1000 AND wall_time<3000, "1s-3s", wall_time>=3000 AND wall_time<6000, "3s-6s",wall_time>=4000 AND wall_time<10000, "6s-10s",wall_time>=10000 AND wall_time<30000, "10s-30s", wall_time>=30000, ">=30s")
| iplocation client_ipaddress |fields requestcount,Country | eval requestcount=1 |  chart per_second(requestcount) AS RequestPerSec over Country  by  Latency

Looks like Chart command doesnt allow per_second. Is there a way to display something like below

Country | 0-0.5s | 0.5s-1s | 1s-3s | 3s-6s | 6s-10s | 10s-30s | >30s
India | 3 | 5 | 6| 7 | 7|5 |1 |0

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...