How to generate a search to find unique IPs hitting a specific URL in Specific Time Range?

[mistydennis]

Hello - I'm trying to write a search string that finds unique IPs hitting a specific URL in 30 minute bursts. For example, if src_ip 123456.00 hits "www.foo.com" five times in a 30 minute period, I only want it to count as one hit.

How is this done?

[woodcock]

Like this:

index=foo sourcetype=bar "www.foo.com"| dedup src_ip | table src_ip

[DalJeanis · Accepted solution]

if you want fixed 30 minute periods -

 index=foo sourcetype=bar "www.foo.com"| bin _time span=30m | stats count by _time src_ip | table _time  src_ip

if you want floating 30m periods, and for example want to count events that are more than 15m apart as separate

 index=foo sourcetype=bar "www.foo.com"| transaction src_ip maxspan=30m maxpause=15m keeporphans=true

With either one of those, you are then going to drop the result into something like

| stats count by src_ip

[mistydennis]

Thanks, DalJeanis - this is what I was looking for!

[DalJeanis]

Glad to help.

[somesoni2]

Without much info to go on, try something like this

index=foo sourcetype=bar "www.foo.com"| stats count by src_ip | table src_ip

[mistydennis]

So that will find the unique IPs, but what I'm struggling with is applying the 30 minute time filter to them. So if my url gets hit 100 times in 30 minutes by the same unique IP, I don't want the 100 hits to apply towards my count. I only want it to act as 1 hit.