Getting Data In

IIS Logs - Query to report on file downloads

JoshuaThompson
New Member

Hello,

I am currently using a trial version of Splunk 6.1 Enterprise. I am looking for a query that will create a report that shows a count of how many times files from our website were downloaded over a given period. There are about 10 different files names I need to report on.

All file downloads will be PDFs. All IIS logs are indexed in Splunk under "Files and Directories". The logs are in the IIS format (not W3C) and Splunk does not appear to be recognizing the "target" field.

Here is my query:
*.PDF "\\UNC PATH TO SERVER LOGS\*"

I get results with this query that shows the PDF access but I am unsure what to do next to get the information I need.

Tags (1)
0 Karma

lguinn2
Legend

Try this:

.pdf get
| rex "GET,\s+(?<fileName>\S+.pdf),"
| stats count by fileName
0 Karma

JoshuaThompson
New Member

That is exactly what I am looking for. Thank you.

0 Karma

lguinn2
Legend

.pdf get NOT (xx.xx.xx.xx OR xx.xx.xx.xx) NOT ("file4.pdf" OR "file5.pdf")
| rex "GET,\s+(?\S+.pdf),"
| stats count by fileName

will probably work!

0 Karma

JoshuaThompson
New Member

Perfect! Thanks. I also need to be able to exclude certain IP Addresses and certain PDF file names. Is this possible?

0 Karma

JoshuaThompson
New Member

Thank you for your help. Attached is sample output from my above query. Other results are similar except for date/time and the PDF file name. I cannot upload a screen shot at this time.

Output:
87.234.63.90, -, 5/21/2014, 0:45:24, W3SVC3, xxxxxxxxx, xx.xx.xx.xx, 2062, 604, 240268, 200, 0, GET, /perspectives/MarketPerspectives_2014_4.pdf, -,

date_hour = 22
date_mday = 21
date_minute = 55
date_month = may
eventtype = wineventlog-index eventtype = winevents
host = xxxxxxxxx
index = main
source = \xxxxxxxxx\u_in14052100.log
sourcetype = u_in

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Can you post some sample events (output of your query) and the expected report format? You may have to setup some field-extractions and then run the necessary reporting command to generate expected output.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...