Examples of useful reports

Examples of useful reports

This section shows you some reports you can execute using data from the sampledata and _internal default indexes. Paste any of these reports into the search bar in Splunk Web to see it in action (unless otherwise noted). Some of the examples require you to substitute your own data to see meaningful results. If noted, some examples require you to install certain applications.

Note: Extract fields from search results to create reports using interactive field extraction in Splunk Web, or with the rex command in a search.

Internal Splunk log data

Create reports on Splunk internal data. Report on things like indexing performance and the CPU utilization of Splunk processes.

Indexing performance

See the indexing kps (indexing thruput):

Plot the average eps and kps by time:

CPU utilization of Splunk processes

See the CPU utilization of Splunk processes in a bar chart sorted in descending order:

System monitoring data

Create reports on data from your system monitoring utilities with the Splunk for UNIX application. You must install Splunk for UNIX to run these reports. These samples illustrate what some of the system monitoring reports look like.

Download and install Splunk for UNIX from SplunkBase. Splunk for UNIX configures Splunk to index UNIX system monitoring utility data.

See the % CPU usage over time:

See the % CPU for processes that contain the word "splunkd":

See the % CPU used per user:

Web access data

Create reports on your web access and traffic data with these examples, or use the Splunk for Web Access application. Download and install Splunk for Web Access from SplunkBase. The Splunk for Web Access application has a large number of saved reports that you can run on your Web access data.

The following examples illustrate some of the kinds of reports you can run on Web access data with Splunk.

See the top Web clients used:

See a chart of data transferred (in bytes) by time:

Note: The following examples assume you have extracted fields for clientip and referer data in your search results.

See the number of unique visitors by hour of the day:

See the top traffic peak hours of a day:

See the number of unique visitors by day of week:

See the top traffic peak days of a week:

See the top visits by referrer:

Web application data

Create reports from data of Web applications. See the top Web applications and their violations from a log:

(This example assumes you have the web_app and violation fields extracted.)

See the top Web applications and the top 3 violations for each application (using the sort command at the end to optionally sort the results):

See the top Web applications and the top 3 violations for each application, and restrict the search to only include the top 10 Web applications (using the subsearch to pre-filter the results).

Firewall (or connection) activity

Create reports on the connection activity of your server or firewall. You can report on any type of activity: # of connections, # of accepts, # of denies, bytes transferred.

See the top port activity:

See the top activity of a source host ID:

See the most active destination ports:

See the ports with the top number of denials:

Email activity or email transactions

Create reports of email activity by applying these examples to your own email data.

Note: These examples use the rex command to extract the fields on which to report. You can also extract fields by configuring field extraction at index time.

Note: The sampledata index doesn't contain email data used to demonstrate these reports. To try these, supply email data from your own sources and tailor these examples to try these reports.

See the top senders:

See the unique number of recipients to whom a sender sent messages:

See the top recipients of messages:

Transaction data

For example, let's say that you have a set of purchase transaction data that looks like this:

1216725748296,I,toystore,S,1
1216725748396,I,toystore,S,1
1216725748497,E,toystore,S,30
1216725748598,E,toystore,S,40
1216725748698,I,toystore,S,1
1216725754024,I,toystore,S,2
1216725754126,I,toywarehouse,S,2

Now, let's assume that you configure Splunk to extract the following fields from this comma-delimited data:

• The timestamp in milliseconds since Jan 1, 1970 epoch.
• A character code indicating logger priority (I = info, E = error).
• The supplier name.
• A character code indicating business stage (S = customer is searching).
• A numerical event code indicating the outcome of the process.

With these fields, you can generate the following reports:

See a table showing the count of each supplier by logger code (priority):

See a table showing the count of each supplier by logger code (priority). Also, rename the priority=I as successCount, and priority=E as failCount, then fill the empty values with 0:

See a table showing the count of each supplier by logger code with the sum of successCount and failCount as totalCount (in a 3rd column):