Help with DNS Top 10, HTTP Traffic Volume by Day, and Time-Based Line Chart BOTSv1

[samaG02]

Hi all,

I’m working with the BOTSv1 dataset in Splunk and I’m trying to solve three tasks.
I would appreciate some guidance on the best SPL approach for each of these.

1. Find the top 10 most requested domains in DNS traffic

2. Identify which day in the dataset has the highest HTTP traffic volume

3. Create a line chart showing data volume over time

[samaG02]

-

[livehybrid · Accepted solution]

Hi @samaG02 

1. Find the top 10 most requested domains in DNS traffic

index=yourIndex sourcetype=stream:dns | top 10 query

(This assumes the query field contains the DNS query being made - its been a while since Ive used this dataset!)

2. Identify which day in the dataset has the highest HTTP traffic volume

index=yourIndex sourcetype=stream:http | stats sum(bytes) as http_volume by date_mday | sort - http_volume | head 1

(This assumes the HTTP events contain a field named bytes with the traffic size. date_mday is the day of the month. If you need the full date you could use:

index=yourIndex sourcetype=stream:http | bin span=1d _time | stats sum(bytes) as http_volume by _time | sort - http_volume | head 1

3. Create a line chart showing data volume over time

I dont know which sourcetype this is in but you could do something like:

index=yourIndex | timechart span=1h sum(bytes) AS TotalDataVolume

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing