Reporting

Generate report by IP from DDoS Attacks

phatlenix
New Member

We keep getting DDoS attacks that target our web applications. I've setup Splunk and have all of our servers forwarding logs via syslog-ng which works like a charm.

I also setup an extracted field called "ip" that extracts the ip address from the apache logs which also works great.

I can't seem to figure how do I create a timeline chart with the count of each hit/event so I can determine who is at the top of the list.

When I "generate report.." that works fine, but how do I use my custom field as a search query? I've used:

sourcetype="access_combined" count(ip)

and can't get any results.

Any tips? Thanks!

Tags (1)
0 Karma
1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

Ron_Naken
Splunk Employee
Splunk Employee

phatlenix
New Member

Yea, that's what I figured but after making sure I wasn't retarded... I renamed by field to 'xxx' rather than 'ip' and it worked like a charm. Perhaps "ip" is reserved/cannot be used 🙂

Thanks for the help though

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...