Splunk Search

Count client IP access to Web Server

goldarrow
New Member

Hi All,

I want to count how many IP access to my Web Server in a period ?
I really don't know
Please show me sample : regex and etc ...

Thanks
goldarrow

Tags (1)
0 Karma

dwaddle
SplunkTrust
SplunkTrust

Not sure your question really falls into the area of regex. I'm going to make some assumptions:

  1. You are using Apache or similar webserver that logs in the NCSA-style "combined" log format
  2. You have configured Splunk to index those combined logs and they are being indexed with the proper sourcetype recognition and field extraction is happening as it should

Assuming both of those are true, then what you want should be a simple search in Splunk, something like:

sourcetype=access_combined | timechart dc(src_ip)

If my assumptions are off, you're going to have to clarify some so we can tell where you are.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...