Splunk Search

Is it possible to query IIS logs for a monthly web application hit count for multiple web applications on a domain?

jasonmhamilton
New Member

Hello,

I was wondering if it is possible to use Splunk to query IIS logs for a monthly application hit count for multiple web applications on the same domain?

The report I need to submit would look something like:
http://domain/webapp1/   -  ## total monthly hits
http://domain/webapp2/   -  ## total monthly hits
....

I just need the overall total monthly hit count and not the total unique IP address hit count.

Any help would be much appreciated.  Thank you!

Labels (1)
0 Karma

Chef
Explorer

The easiest way would be to just run two separate searches to get your counts:

index=iis_index url=http://domain/webapp1/* | stats count
index=iis_index url=http://domain/webapp2/* | stats count


And just change your time period to be for the month.

If you wanted to do it in one search, you could do something like the following:

index=iis_index url=http://domain/webapp1/* OR url=http://domain/webapp2/*
| rex "http://domain/(?<webapp>[^/]+"
| stats count by webapp

This second search will extract a new field named webapp which you will be able to use in stats functions.

0 Karma

jasonmhamilton
New Member

I'm a Splunk newbie. How do I specify the timespan to a month and specify which month or start and end date/time for the query?

I currently use a LogParser query on the IIS logs to do this and wrote a script that I call with just the start and end date and time as variables (e.g "2022-01-01 00:00:00" "2022-01-31 23:59:59" as the start/end date and time). That method will not be an option much longer so I am looking to use Splunk for a new way of gathering these monthly metrics.

0 Karma

Chef
Explorer

When you ingest these logs into Splunk, it will detect the timestamp from the logs and store them accordingly.

So when you write a Splunk search, you will have the option of what timeframe you wish to search - you can see more details here:
https://docs.splunk.com/Documentation/Splunk/8.2.4/Search/Selecttimerangestoapply 

There's a lot of preset time criteria you can use such as "Previous Month" and you can even select specific time and date ranges too.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...