https://community.splunk.com/t5/Splunk-Search/Searching-for-beaconing-activity/m-p/80706#M20394 <P>you can bin _time and then count the number of bins that something appears in:</P> <P>maybe something like <CODE>eval foo = host + " : " + dest| bin _time span=1h |stats count foo AS concount by _time | stats value(concount) count by foo</CODE></P> <P>This should give you the numbers of connections per hour and the number of hours that they occurred. </P> Tue, 09 Feb 2016 18:50:52 GMT wkupersa 2016-02-09T18:50:52Z https://community.splunk.com/t5/Splunk-Search/Searching-for-beaconing-activity/m-p/80705#M20393 <P>Hi, </P> <P>I'm pretty new to spluk, <BR /> I'm looking for some help with malware detection. <BR /> What would the search expression look like to detect beaconing activity from infected hosts?</P> <P>my unknowns here would be "host" and "destination" since i have no idea what may be infected and with what malware.<BR /> Thanks.</P> Mon, 01 Apr 2013 14:48:13 GMT https://community.splunk.com/t5/Splunk-Search/Searching-for-beaconing-activity/m-p/80705#M20393 zabarai 2013-04-01T14:48:13Z https://community.splunk.com/t5/Splunk-Search/Searching-for-beaconing-activity/m-p/80706#M20394 <P>you can bin _time and then count the number of bins that something appears in:</P> <P>maybe something like <CODE>eval foo = host + " : " + dest| bin _time span=1h |stats count foo AS concount by _time | stats value(concount) count by foo</CODE></P> <P>This should give you the numbers of connections per hour and the number of hours that they occurred. </P> Tue, 09 Feb 2016 18:50:52 GMT https://community.splunk.com/t5/Splunk-Search/Searching-for-beaconing-activity/m-p/80706#M20394 wkupersa 2016-02-09T18:50:52Z