How to process BOTS data?

zakaria1996-cyb — Tue, 25 Nov 2025 19:20:53 GMT

Hi everyone,

I'm working with the botsv1 attack-only dataset and I need some guidance on how to approach a few SPL tasks. The dataset is available here:
https://s3.amazonaws.com/botsdataset/botsv1/botsv1-attack-only.tgz

I want to learn how to do the following:

Find the 10 most requested domains in the DNS traffic.
Identify which calendar day in the dataset has the highest HTTP traffic volume.
Create a line chart that shows data volume over time.

I'm mainly looking for advice on how to structure the searches and how to approach the analysis step-by-step.

Thanks in advance.

Re: How to process BOTS data?

livehybrid — Sat, 29 Nov 2025 16:49:05 GMT

Hi @zakaria1996-cyb

This looks like the same question asked by another user earlier this week, please find the answer below.

https://community.splunk.com/t5/Splunk-Search/o/m-p/755834

1. Find the top 10 most requested domains in DNS traffic

index=yourIndex sourcetype=stream:dns | top 10 query

(This assumes the query field contains the DNS query being made - its been a while since Ive used this dataset!)

2. Identify which day in the dataset has the highest HTTP traffic volume

index=yourIndex sourcetype=stream:http | stats sum(bytes) as http_volume by date_mday | sort - http_volume | head 1

(This assumes the HTTP events contain a field named bytes with the traffic size. date_mday is the day of the month. If you need the full date you could use:

index=yourIndex sourcetype=stream:http | bin span=1d _time | stats sum(bytes) as http_volume by _time | sort - http_volume | head 1

3. Create a line chart showing data volume over time

I dont know which sourcetype this is in but you could do something like:

index=yourIndex | timechart span=1h sum(bytes) AS TotalDataVolume

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

topic Re: How to process BOTS data? in Splunk Search

How to process BOTS data?

Re: How to process BOTS data?