SPL
Real Time IIS Web Site Connections
Description
Assuming JSESSIONID is auto-extracted, run the following REAL-TIME search (choose your window, I typically go with 5 minutes):
3 4
sourcetype="iis" | stats dc(JSESSIONID)
GoSplunk SPL + dashboard repository
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.