Splunk Search

Is it possible to query IIS logs for a monthly web application hit count for multiple web applications on a domain?

New Member


I was wondering if it is possible to use Splunk to query IIS logs for a monthly application hit count for multiple web applications on the same domain?

The report I need to submit would look something like:
http://domain/webapp1/   -  ## total monthly hits
http://domain/webapp2/   -  ## total monthly hits

I just need the overall total monthly hit count and not the total unique IP address hit count.

Any help would be much appreciated.  Thank you!

Labels (1)
0 Karma


The easiest way would be to just run two separate searches to get your counts:

index=iis_index url=http://domain/webapp1/* | stats count
index=iis_index url=http://domain/webapp2/* | stats count

And just change your time period to be for the month.

If you wanted to do it in one search, you could do something like the following:

index=iis_index url=http://domain/webapp1/* OR url=http://domain/webapp2/*
| rex "http://domain/(?<webapp>[^/]+"
| stats count by webapp

This second search will extract a new field named webapp which you will be able to use in stats functions.

0 Karma

New Member

I'm a Splunk newbie. How do I specify the timespan to a month and specify which month or start and end date/time for the query?

I currently use a LogParser query on the IIS logs to do this and wrote a script that I call with just the start and end date and time as variables (e.g "2022-01-01 00:00:00" "2022-01-31 23:59:59" as the start/end date and time). That method will not be an option much longer so I am looking to use Splunk for a new way of gathering these monthly metrics.

0 Karma


When you ingest these logs into Splunk, it will detect the timestamp from the logs and store them accordingly.

So when you write a Splunk search, you will have the option of what timeframe you wish to search - you can see more details here:

There's a lot of preset time criteria you can use such as "Previous Month" and you can even select specific time and date ranges too.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...