identify scanner and malicious domain

[cyberfan]

For example, My ip is 202.101.53.4, I want to identify what are the domains sent me the most number of packets (most frequently), what will be the query look like?

I want to know the domain who sent me the most number of traffics, what would be the query look like?

I want to know the vulnerability scanner the malicious domain is using for reconaissance, which filed I can get info from splunk?

[richgalloway]

We can't answer your questions without knowing what data you have indexed in Splunk.  Obviously, if you don't have network traffic data then no query can help you.  If you do have network traffic data then the exact query will depend on how the tool that reported that data chose to format it.  See the Splunk Security Essentials app for examples.

I know of no way to determine which vulnerability scanner a remote site is using.