Search code examples
splunksplunk-query

How to find traffic and number of hits per URL in Splunk?


I have been using Splunk as a log monitoring tool but recently got to know that we will get network traffic and number of hits per URL.

For example, I have a URL like the one below and I want to know the total number of hits that occurred over the last week:

https://stackoverflow.com/

What would be the query that I need to write to get the number of hits (count) per day/period of time in Splunk?

I tried this:

"url" | stats sum(linecount) as Total

which is returning >1000 hits count for the last 15 minutes, which is not correct.

Thanks in advance.


Solution

  • It would be quick and accurate when you mention index, host and site names.

    index name = environment of the application like SIT/UAT/QA/pre-prod/production

    host name = In which instance application is hosted

    site name = in my example it will be https://stackoverflow.com

    Query = index="SIT*" host="*host_name*" "https://stackoverflow.com" "/questions" | stats sum(linecount) as Total

    by executing above query I can get number of hits for stackoverflow.com/questions url.

    The above query has given accurate results and in splunk we do have drop down option to select period of time.