Splunk Search

How to generate a search to find unique IPs hitting a specific URL in Specific Time Range?

Communicator

Hello - I'm trying to write a search string that finds unique IPs hitting a specific URL in 30 minute bursts. For example, if src_ip 123456.00 hits "www.foo.com" five times in a 30 minute period, I only want it to count as one hit.

How is this done?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

if you want fixed 30 minute periods -

 index=foo sourcetype=bar "www.foo.com"| bin _time span=30m | stats count by _time src_ip | table _time  src_ip

if you want floating 30m periods, and for example want to count events that are more than 15m apart as separate

 index=foo sourcetype=bar "www.foo.com"| transaction src_ip maxspan=30m maxpause=15m keeporphans=true

With either one of those, you are then going to drop the result into something like

| stats count by src_ip

View solution in original post

Esteemed Legend

Like this:

index=foo sourcetype=bar "www.foo.com"| dedup src_ip | table src_ip
0 Karma

SplunkTrust
SplunkTrust

if you want fixed 30 minute periods -

 index=foo sourcetype=bar "www.foo.com"| bin _time span=30m | stats count by _time src_ip | table _time  src_ip

if you want floating 30m periods, and for example want to count events that are more than 15m apart as separate

 index=foo sourcetype=bar "www.foo.com"| transaction src_ip maxspan=30m maxpause=15m keeporphans=true

With either one of those, you are then going to drop the result into something like

| stats count by src_ip

View solution in original post

Communicator

Thanks, DalJeanis - this is what I was looking for!

0 Karma

SplunkTrust
SplunkTrust

Glad to help.

0 Karma

SplunkTrust
SplunkTrust

Without much info to go on, try something like this

index=foo sourcetype=bar "www.foo.com"| stats count by src_ip | table src_ip

Communicator

So that will find the unique IPs, but what I'm struggling with is applying the 30 minute time filter to them. So if my url gets hit 100 times in 30 minutes by the same unique IP, I don't want the 100 hits to apply towards my count. I only want it to act as 1 hit.

0 Karma