Splunk Search

Is it possible to query IIS logs for a monthly web application hit count for multiple web applications on a domain?

New Member


I was wondering if it is possible to use Splunk to query IIS logs for a monthly application hit count for multiple web applications on the same domain?

The report I need to submit would look something like:
http://domain/webapp1/   -  ## total monthly hits
http://domain/webapp2/   -  ## total monthly hits

I just need the overall total monthly hit count and not the total unique IP address hit count.

Any help would be much appreciated.  Thank you!

Labels (1)
0 Karma


The easiest way would be to just run two separate searches to get your counts:

index=iis_index url=http://domain/webapp1/* | stats count
index=iis_index url=http://domain/webapp2/* | stats count

And just change your time period to be for the month.

If you wanted to do it in one search, you could do something like the following:

index=iis_index url=http://domain/webapp1/* OR url=http://domain/webapp2/*
| rex "http://domain/(?<webapp>[^/]+"
| stats count by webapp

This second search will extract a new field named webapp which you will be able to use in stats functions.

0 Karma

New Member

I'm a Splunk newbie. How do I specify the timespan to a month and specify which month or start and end date/time for the query?

I currently use a LogParser query on the IIS logs to do this and wrote a script that I call with just the start and end date and time as variables (e.g "2022-01-01 00:00:00" "2022-01-31 23:59:59" as the start/end date and time). That method will not be an option much longer so I am looking to use Splunk for a new way of gathering these monthly metrics.

0 Karma


When you ingest these logs into Splunk, it will detect the timestamp from the logs and store them accordingly.

So when you write a Splunk search, you will have the option of what timeframe you wish to search - you can see more details here:

There's a lot of preset time criteria you can use such as "Previous Month" and you can even select specific time and date ranges too.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...