I was wondering if it is possible to use Splunk to query IIS logs for a monthly application hit count for multiple web applications on the same domain?
The report I need to submit would look something like:
http://domain/webapp1/ - ## total monthly hits
http://domain/webapp2/ - ## total monthly hits
I just need the overall total monthly hit count and not the total unique IP address hit count.
Any help would be much appreciated. Thank you!
The easiest way would be to just run two separate searches to get your counts:
index=iis_index url=http://domain/webapp1/* | stats count index=iis_index url=http://domain/webapp2/* | stats count
And just change your time period to be for the month.
If you wanted to do it in one search, you could do something like the following:
index=iis_index url=http://domain/webapp1/* OR url=http://domain/webapp2/* | rex "http://domain/(?<webapp>[^/]+" | stats count by webapp
This second search will extract a new field named webapp which you will be able to use in stats functions.
I'm a Splunk newbie. How do I specify the timespan to a month and specify which month or start and end date/time for the query?
I currently use a LogParser query on the IIS logs to do this and wrote a script that I call with just the start and end date and time as variables (e.g "2022-01-01 00:00:00" "2022-01-31 23:59:59" as the start/end date and time). That method will not be an option much longer so I am looking to use Splunk for a new way of gathering these monthly metrics.
When you ingest these logs into Splunk, it will detect the timestamp from the logs and store them accordingly.
So when you write a Splunk search, you will have the option of what timeframe you wish to search - you can see more details here:
There's a lot of preset time criteria you can use such as "Previous Month" and you can even select specific time and date ranges too.