Splunk Search

DDoS: How to find average connection count per IP in 5 minute window?

zachsisinst
Explorer

Hi friends, I am trying to piece together some splunk searches across application logs to try and piece together what 'normal' traffic patterns look like, vs DDoS attacking IP addresses. The end goal is to answer the question: "For each IP that connects to our application, what is the average connection count within a 5m span, across a 2 hour period? What are the outlier ( greater than average) 5m span connection counts? 

I have the following timechart which has been useful, but I'm sure there is a better way to do this. 

 

index=myapplicationindex sourcetype=_json cluster=cluster23 | timechart span=5m count by x_forwarded_for where count > 75

 

 

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Use streamstats with time_window=5m (there is however an upper limit on events within the window - by default it's 10000 - so if you accumulate more than this number, your search may fail or produce erroneous results).

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...