New Keyword App

One of the most common requests I get from new customers is that they want to centrally collect all their machine generated time series data and search for a keyword like error or RuntimeException. Obviously Splunk can do this. Then, the next set of questions concern things like give me the top hosts or applications producing this keyword, show me a baseline of last week vs this week for this keyword, show me a slope line on the trend for this or any keyword(s), find outliers that go beyond the average occurrences for the keyword and then try to predict what may happen in the future.

To answer these questions and then some, I’ve created an app template that you can download from Splunkbase and simply install the Keyword App. The app has no inputs as it uses your own indexed data. You can modify the default indexes for the role that uses the app in Manager to include indexes beyond main. Usually, what I do next in these blog entries is describe how to use the app. However, in this case, a picture is worth a thousand words. Rather than continue to entertain you with my prose, I’ll simply embed the the self explanatory dashboards here.

Top Host, Sourcetype, Source

Top Host, Sourcetype, and Source for Keyword

Comparing Present Count vs. Past Count

Slope for Trend

Find Outliers

Predict Future Counts (Recession Predict is Jack Coate’s idea)

There’s a Donut Chart (Ron Naken’s Module) that allows you to split your list of keywords by top 10 host, source, or sourcetypes and see the distribution of events.

Split Keyword(s) Distribution by Top 10 Hosts, Source, or Sourcetype

Here are rare events based on your filter:

Rare

Finally, here are rare events based on punctuation.

Punct

Conclusion

Hopefully, this template will satisfy all your needs out of the box. If you need to modify the searches, make a copy of the app’s default/data/ui/views/<dashboard>.xml file and put it into the app’s local/data/ui/views/<dashboard>.xml file and edit your local copy. I’m hoping this app will save you some time from configuring these common tasks.

/en_us/blog/fragments/digital-resilience-pays-off
Style
two-column

Related Articles

Harness the Power of Cisco Talos Threat Intelligence Across Splunk Security Products
Security
4 Minute Read

Harness the Power of Cisco Talos Threat Intelligence Across Splunk Security Products

Leverage Cisco Talos’ threat intelligence through Cisco Talos Intelligence for Enterprise Security, the Cisco Talos Intelligence connector for Splunk SOAR, and as a globally enabled feature in Splunk Attack Analyzer.
The Modern SIEM Has Come a Long Way From Your Grandmother’s SIEM
Security
2 Minute Read

The Modern SIEM Has Come a Long Way From Your Grandmother’s SIEM

Explore how modern SIEM solutions tackle scalability, alert fatigue, and advanced threat detection with automation, machine learning, and real-time insights for efficient SOC workflows.
Meduza Stealer Analysis: A Closer Look at its Techniques and Attack Vector
Security
18 Minute Read

Meduza Stealer Analysis: A Closer Look at its Techniques and Attack Vector

Uncover Meduza Stealer, a 2023 malware targeting credentials and crypto wallets. Explore its evasion tactics, attack methods, and Splunk’s expert insights for enhanced security.
Cisco Intends to Acquire Threat Detection and Defense Company SnapAttack, Driving Further Splunk Innovation to Power the SOC of the Future
Security
2 Minute Read

Cisco Intends to Acquire Threat Detection and Defense Company SnapAttack, Driving Further Splunk Innovation to Power the SOC of the Future

Cisco announces it intent to acquire threat detection and defense company SnapAttack, driving further Splunk innovation to power the SOC of the future.
Logs Are For Campfires: Log Data, Big Data, and Splunk Asset & Risk Intelligence
Security
3 Minute Read

Logs Are For Campfires: Log Data, Big Data, and Splunk Asset & Risk Intelligence

Discover how Splunk Asset and Risk Intelligence (ARI) transforms log data into actionable insights. From automated asset discovery to risk and compliance management, ARI empowers organizations with real-time visibility, vulnerability tracking, and proactive threat mitigation. Elevate your security posture today.
Introducing the OT Security Solution Accelerator
Security
2 Minute Read

Introducing the OT Security Solution Accelerator

The OT Security Solution Accelerator provides prescriptive guidance around data collection, reference architectures, and a Splunk app with existing content to accelerate their capabilities.
Bypassing the Bypass: Detecting Okta Classic Application Sign-On Policy Evasion
Security
11 Minute Read

Bypassing the Bypass: Detecting Okta Classic Application Sign-On Policy Evasion

The Splunk Threat Research Team dives into the Okta policy bypass vulnerability, offering detection insights and effective hunting strategies for security teams.
CosmicSting: A Critical XXE Vulnerability in Adobe Commerce and Magento (CVE-2024-34102)
Security
10 Minute Read

CosmicSting: A Critical XXE Vulnerability in Adobe Commerce and Magento (CVE-2024-34102)

The Splunk Research Team dissects the technical intricacies of the CosmicSting vulnerability, explores its potential impact on affected systems, and provides detection opportunities and mitigation strategies.
Cracking Braodo Stealer: Analyzing Python Malware and Its Obfuscated Loader
Security
10 Minute Read

Cracking Braodo Stealer: Analyzing Python Malware and Its Obfuscated Loader

The Splunk Threat Research Team break down Braodo Stealer's loader mechanisms, obfuscation strategies, and payload behavior.
/en_us/blog/fragments/about-splunk
/en_us/blog/fragments/subscribe-footer