New Keyword App

One of the most common requests I get from new customers is that they want to centrally collect all their machine generated time series data and search for a keyword like error or RuntimeException. Obviously Splunk can do this. Then, the next set of questions concern things like give me the top hosts or applications producing this keyword, show me a baseline of last week vs this week for this keyword, show me a slope line on the trend for this or any keyword(s), find outliers that go beyond the average occurrences for the keyword and then try to predict what may happen in the future.

To answer these questions and then some, I’ve created an app template that you can download from Splunkbase and simply install the Keyword App. The app has no inputs as it uses your own indexed data. You can modify the default indexes for the role that uses the app in Manager to include indexes beyond main. Usually, what I do next in these blog entries is describe how to use the app. However, in this case, a picture is worth a thousand words. Rather than continue to entertain you with my prose, I’ll simply embed the the self explanatory dashboards here.

Top Host, Sourcetype, Source

Top Host, Sourcetype, and Source for Keyword

Comparing Present Count vs. Past Count

Slope for Trend

Find Outliers

Predict Future Counts (Recession Predict is Jack Coate’s idea)

There’s a Donut Chart (Ron Naken’s Module) that allows you to split your list of keywords by top 10 host, source, or sourcetypes and see the distribution of events.

Split Keyword(s) Distribution by Top 10 Hosts, Source, or Sourcetype

Here are rare events based on your filter:

Rare

Finally, here are rare events based on punctuation.

Punct

Conclusion

Hopefully, this template will satisfy all your needs out of the box. If you need to modify the searches, make a copy of the app’s default/data/ui/views/<dashboard>.xml file and put it into the app’s local/data/ui/views/<dashboard>.xml file and edit your local copy. I’m hoping this app will save you some time from configuring these common tasks.

/en_us/blog/fragments/digital-resilience-pays-off
Style
two-column

Related Articles

Announcing General Availability of Cisco Talos Intelligence in Splunk Attack Analyzer
Security
2 Minute Read

Announcing General Availability of Cisco Talos Intelligence in Splunk Attack Analyzer

We are pleased to announce the general availability of Cisco Talos threat intelligence to all Splunk Attack Analyzer customers globally.
LLM Security: Splunk & OWASP Top 10 for LLM-based Applications
Security
11 Minute Read

LLM Security: Splunk & OWASP Top 10 for LLM-based Applications

Threats to LLMs are real. Let’s look at top LLM threats and show you how, with Splunk, you can better defend LLM-based applications and their users.
Driving vSOC Detection with Machine Learning
Security
3 Minute Read

Driving vSOC Detection with Machine Learning

In this blog, Splunker Jim Goodrich takes a deep dive into an API security use case, using machine learning to detect API anomalies, and more.
Embracing Observability Tools to Empower Security Incident Response
Security
6 Minute Read

Embracing Observability Tools to Empower Security Incident Response

Bridge the gap between development and security with OpenTelemetry and observability tools.
Staff Picks for Splunk Security Reading July 2024
Security
4 Minute Read

Staff Picks for Splunk Security Reading July 2024

Welcome to the Splunk staff picks blog, featuring a curated list of presentations, whitepapers, and customer case studies that our Splunk security experts feel are worth a read.
AcidPour Wiper Malware: Threat Analysis and Detections
Security
6 Minute Read

AcidPour Wiper Malware: Threat Analysis and Detections

The Splunk Threat Research Team provides an analysis of AcidPour and how to use Splunk’s out-of-the-box security content to help defend against this wiper malware.
How Splunk SOAR is Helping Organizations Achieve a More Resilient Approach to Security
Security
3 Minute Read

How Splunk SOAR is Helping Organizations Achieve a More Resilient Approach to Security

We worked with Peerspot to capture some of the ways customers have found success while using Splunk SOAR as part of their security stack.
Splunk Security Content for Impact Assessment of CrowdStrike Windows Outage
Security
4 Minute Read

Splunk Security Content for Impact Assessment of CrowdStrike Windows Outage

This blog is intended to help existing Splunk customers who are also customers of CrowdStrike gain visibility into how the CrowdStrike outage may be impacting their organizations.
Splunk at Black Hat 2024: Strategic Transformations to Power the SOC of the Future
Security
3 Minute Read

Splunk at Black Hat 2024: Strategic Transformations to Power the SOC of the Future

At Black Hat 2024, Splunk will demonstrate how we’re empowering security teams to embrace strategic transformations and navigate the complex threat landscape.
/en_us/blog/fragments/about-splunk
/en_us/blog/fragments/subscribe-footer