Generate report by IP from DDoS Attacks

[phatlenix]

We keep getting DDoS attacks that target our web applications. I've setup Splunk and have all of our servers forwarding logs via syslog-ng which works like a charm.

I also setup an extracted field called "ip" that extracts the ip address from the apache logs which also works great.

I can't seem to figure how do I create a timeline chart with the count of each hit/event so I can determine who is at the top of the list.

When I "generate report.." that works fine, but how do I use my custom field as a search query? I've used:

sourcetype="access_combined" count(ip)

and can't get any results.

Any tips? Thanks!

[Ron_Naken · Accepted solution]

sourcetype="access_combined" | timechart count by ip

You might want to check out this Splunk search tutorial: http://www.splunk.com/base/Documentation/4.1.7/User/WelcometotheSplunkTutorial

There are sub-tutorials for the stats, chart, and timechart commands: http://www.splunk.com/base/Documentation/4.1.7/SearchReference/Timechart http://www.splunk.com/base/Documentation/4.1.7/SearchReference/Chart http://www.splunk.com/base/Documentation/4.1.7/SearchReference/Stats

[phatlenix]

Yea, that's what I figured but after making sure I wasn't retarded... I renamed by field to 'xxx' rather than 'ip' and it worked like a charm. Perhaps "ip" is reserved/cannot be used 🙂

Thanks for the help though