Splunk Search

Is it possible to query IIS logs for a monthly web application hit count for multiple web applications on a domain?

jasonmhamilton
New Member

Hello,

I was wondering if it is possible to use Splunk to query IIS logs for a monthly application hit count for multiple web applications on the same domain?

The report I need to submit would look something like:
http://domain/webapp1/   -  ## total monthly hits
http://domain/webapp2/   -  ## total monthly hits
....

I just need the overall total monthly hit count and not the total unique IP address hit count.

Any help would be much appreciated.  Thank you!

Labels (1)
0 Karma

Chef
Explorer

The easiest way would be to just run two separate searches to get your counts:

index=iis_index url=http://domain/webapp1/* | stats count
index=iis_index url=http://domain/webapp2/* | stats count


And just change your time period to be for the month.

If you wanted to do it in one search, you could do something like the following:

index=iis_index url=http://domain/webapp1/* OR url=http://domain/webapp2/*
| rex "http://domain/(?<webapp>[^/]+"
| stats count by webapp

This second search will extract a new field named webapp which you will be able to use in stats functions.

0 Karma

jasonmhamilton
New Member

I'm a Splunk newbie. How do I specify the timespan to a month and specify which month or start and end date/time for the query?

I currently use a LogParser query on the IIS logs to do this and wrote a script that I call with just the start and end date and time as variables (e.g "2022-01-01 00:00:00" "2022-01-31 23:59:59" as the start/end date and time). That method will not be an option much longer so I am looking to use Splunk for a new way of gathering these monthly metrics.

0 Karma

Chef
Explorer

When you ingest these logs into Splunk, it will detect the timestamp from the logs and store them accordingly.

So when you write a Splunk search, you will have the option of what timeframe you wish to search - you can see more details here:
https://docs.splunk.com/Documentation/Splunk/8.2.4/Search/Selecttimerangestoapply 

There's a lot of preset time criteria you can use such as "Previous Month" and you can even select specific time and date ranges too.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...