Reporting
Highlighted

Generate report by IP from DDoS Attacks

New Member

We keep getting DDoS attacks that target our web applications. I've setup Splunk and have all of our servers forwarding logs via syslog-ng which works like a charm.

I also setup an extracted field called "ip" that extracts the ip address from the apache logs which also works great.

I can't seem to figure how do I create a timeline chart with the count of each hit/event so I can determine who is at the top of the list.

When I "generate report.." that works fine, but how do I use my custom field as a search query? I've used:

sourcetype="access_combined" count(ip)

and can't get any results.

Any tips? Thanks!

Tags (1)
0 Karma
Highlighted

Re: Generate report by IP from DDoS Attacks

Splunk Employee
Splunk Employee
Highlighted

Re: Generate report by IP from DDoS Attacks

New Member

Yea, that's what I figured but after making sure I wasn't retarded... I renamed by field to 'xxx' rather than 'ip' and it worked like a charm. Perhaps "ip" is reserved/cannot be used 🙂

Thanks for the help though

0 Karma