Splunk Search

Timechart with TIME, IPADDRESS and count

yatyat
Observer

Hi All,

I have below splunk data:

"new request: 127.0.0.1;url=login.jsp"

which contains the IPADDRESS (EX:127.0.0.1) and the URL (login.jsp)

 

I want to show a table which displays Number of requests made to (login.jsp) from every IPADDRESS on minute basis like below :

 

TimeStamp(Minutes)  IPADDRESS  COUNT

2022-01-13 22:03:00 ipaddress1 count1

2022-01-13 22:03:00 ipaddress2 count2

2022-01-13 22:03:00 ipaddress3 count3

2022-01-13 22:04:00 ipaddress1 count1

2022-01-13 22:04:00 ipaddress2 count2

 

which displays the count in descending order.

Please advise how to achieve this ?

 

Thanks

2022-01-13 22:04:00 ipaddress3 count3

Labels (4)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

It's not obvious whether you have problem with extraction or doing the stats.

But assuming your data is not parsed at all, you need something like that

<your index/sourcetype selection> login.jsp
| rex "new\srequest:\s(?<IPADDR>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| timechart span=1m count by IPADDR
0 Karma

yatyat
Observer

It displays the data in this manner. It is difficult to get the data sorted by count manually.

samplesample

 

 

I need to get the highest number of requests made by an IPADDRESS in a minute. Can you please help?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Ahh, right. The timechart indeed does many separate series. You can do it a bit differently.

<your index/sourcetype selection> login.jsp
| rex "new\srequest:\s(?<IPADDR>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| bin _time span=1m
| stats count by IPADDR _time
| sort - count

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...