Splunk Search

DDoS: How to find average connection count per IP in 5 minute window?

zachsisinst
Explorer

Hi friends, I am trying to piece together some splunk searches across application logs to try and piece together what 'normal' traffic patterns look like, vs DDoS attacking IP addresses. The end goal is to answer the question: "For each IP that connects to our application, what is the average connection count within a 5m span, across a 2 hour period? What are the outlier ( greater than average) 5m span connection counts? 

I have the following timechart which has been useful, but I'm sure there is a better way to do this. 

 

index=myapplicationindex sourcetype=_json cluster=cluster23 | timechart span=5m count by x_forwarded_for where count > 75

 

 

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Use streamstats with time_window=5m (there is however an upper limit on events within the window - by default it's 10000 - so if you accumulate more than this number, your search may fail or produce erroneous results).

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...