Splunk Search

What is the basic search for detecting Multiple HTTP errors from unique IP?

mohsplunking
Path Finder

Hello Splunkers,

Can someone help me with a query to detect multiple http errors from single IP , basically when the status code is in 400s/500s.

Thank you,

regards,

Moh

Labels (1)
Tags (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Basic query is something like this, but will depend on your fields

index=your_source_index status>=400 status<600
| stats count by ip status

You will then get a table of ip+status+count

you can do whatever you want to do with that - what's your goal?

 

0 Karma

mohsplunking
Path Finder

Thanks for your response, the goal is to list the IP's that is causing maximum http errors. Lets say where errors are >100.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mohsplunking,

if you need the total count of errors, the solution from @bowesmana is perfect.

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma

mohsplunking
Path Finder

Hello gcusello,

Thanks for your inputs, However, like  I said the use case is I'm looking for IP that is causing maximum number of http errors(400s,500s) , lets say I'm trying to find a single IP that is causing  over 100 http errors . I think in the query we will have to use eval&case functions too.

Please let me know if you need further clarifications on the above.

Moh.

0 Karma

gcusello
SplunkTrust
SplunkTrust

@mohsplunking ,

if you ne only an alert, as I said, the solution from @bowesmana is perferct and you don't need any additional command.

the eval/case  could be useful if you need to display some additional information e.g. a level of alert quantity.

Ciao.

Giuseppe

0 Karma

bowesmana
SplunkTrust
SplunkTrust

@mohsplunking 

index=your_source_index status>=400 status<600
| stats count by ip
| where count>100

or you can do 

index=your_source_index status>=400 status<600
| top ip 
| where count > 100

but I would prefer stats over top

 

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...