Can anyone please help to create a DOS/DDOS alert without using any application in Splunk?

[mlm]

Hello guys,

Can anyone please help me to create a DOS/DDOS alert without using any application in splunk. 

For example: 

if source IPs sending thousands of TCP packets simultaneously within the 15-20 minutes or so.  

I can't seem to find any docs that related to this.

TIA

[marioespbaires]

Hello there,

did you find how to do it? if so, may you share it? 😄 

[isoutamo]

Hi
To getting help you must 1st tell what you have on your splunk. Describe your log events, indexes etc.
This is doable if/when you have suitable data in splunk.
r. Ismo