Reporting

Generate report by IP from DDoS Attacks

phatlenix
New Member

We keep getting DDoS attacks that target our web applications. I've setup Splunk and have all of our servers forwarding logs via syslog-ng which works like a charm.

I also setup an extracted field called "ip" that extracts the ip address from the apache logs which also works great.

I can't seem to figure how do I create a timeline chart with the count of each hit/event so I can determine who is at the top of the list.

When I "generate report.." that works fine, but how do I use my custom field as a search query? I've used:

sourcetype="access_combined" count(ip)

and can't get any results.

Any tips? Thanks!

Tags (1)
0 Karma
1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

Ron_Naken
Splunk Employee
Splunk Employee

phatlenix
New Member

Yea, that's what I figured but after making sure I wasn't retarded... I renamed by field to 'xxx' rather than 'ip' and it worked like a charm. Perhaps "ip" is reserved/cannot be used 🙂

Thanks for the help though

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...