Splunk SPL: Top Apache Endpoints by Bytes (Daily)

Identify the heaviest Apache endpoints by bandwidth so you can optimize or cache high-cost paths.

What This Splunk Query Does

Aggregates total bytes per endpoint and returns the top 10 by volume.

Supported Sourcetypes

access_combined

When to Use This SPL

Use this to spot costly downloads, API hotspots, or misbehaving routes.

Splunk SPL Query

This Splunk query uses

index=*

as a placeholder. Replace it with your actual index name.

index=* sourcetype=access_combined
| eval endpoint=coalesce(uri_path, uri, url, cs_uri_stem)
| eval bytes=coalesce(bytes, sc_bytes, 0)
| where isnotnull(endpoint)
| stats sum(bytes) as total_bytes by endpoint
| sort - total_bytes
| head 10

Assumptions and Customization

Assumes bytes are in

bytes

or

sc_bytes

. Add

by host

or

by uri_query

if needed.