Hello - I'm trying to write a search string that finds unique IPs hitting a specific URL in 30 minute bursts. For example, if src_ip 123456.00 hits "www.foo.com" five times in a 30 minute period, I only want it to count as one hit.
How is this done?
if you want fixed 30 minute periods -
index=foo sourcetype=bar "www.foo.com"| bin _time span=30m | stats count by _time src_ip | table _time src_ip
if you want floating 30m periods, and for example want to count events that are more than 15m apart as separate
index=foo sourcetype=bar "www.foo.com"| transaction src_ip maxspan=30m maxpause=15m keeporphans=true
With either one of those, you are then going to drop the result into something like
| stats count by src_ip
Like this:
index=foo sourcetype=bar "www.foo.com"| dedup src_ip | table src_ip
if you want fixed 30 minute periods -
index=foo sourcetype=bar "www.foo.com"| bin _time span=30m | stats count by _time src_ip | table _time src_ip
if you want floating 30m periods, and for example want to count events that are more than 15m apart as separate
index=foo sourcetype=bar "www.foo.com"| transaction src_ip maxspan=30m maxpause=15m keeporphans=true
With either one of those, you are then going to drop the result into something like
| stats count by src_ip
Thanks, DalJeanis - this is what I was looking for!
Glad to help.
Without much info to go on, try something like this
index=foo sourcetype=bar "www.foo.com"| stats count by src_ip | table src_ip
So that will find the unique IPs, but what I'm struggling with is applying the 30 minute time filter to them. So if my url gets hit 100 times in 30 minutes by the same unique IP, I don't want the 100 hits to apply towards my count. I only want it to act as 1 hit.