HI, I have a customer using splunk for just syslog. There has recently been a ddos attack, we are looking to report on how much traffic came from the known ddos hosts. In the syslog the router has flagged the known IP's as > msg="torproject.org:Anonymizers, SSI:N" note="ACCESS BLOCK" We can search for this fine, however there is a preceding entry for the sending IP address that is in the syslog where the router has forwarded this from firewall to its ip address check phase. We are looking to get total rows of all traffic from ddos hosts So we search for "torproject" we then want to search again for all ip's that appeared in that first search. Then extract from that search every "src="103.76.173.203:7627" then search for all those Any ideas please? End goal = how much traffic was from ddos hosts and how much wasnt (as a rough %) Thanks in advance
... View more
