New Keyword App

One of the most common requests I get from new customers is that they want to centrally collect all their machine generated time series data and search for a keyword like error or RuntimeException. Obviously Splunk can do this. Then, the next set of questions concern things like give me the top hosts or applications producing this keyword, show me a baseline of last week vs this week for this keyword, show me a slope line on the trend for this or any keyword(s), find outliers that go beyond the average occurrences for the keyword and then try to predict what may happen in the future.

To answer these questions and then some, I’ve created an app template that you can download from Splunkbase and simply install the Keyword App. The app has no inputs as it uses your own indexed data. You can modify the default indexes for the role that uses the app in Manager to include indexes beyond main. Usually, what I do next in these blog entries is describe how to use the app. However, in this case, a picture is worth a thousand words. Rather than continue to entertain you with my prose, I’ll simply embed the the self explanatory dashboards here.

Top Host, Sourcetype, Source

Top Host, Sourcetype, and Source for Keyword

Comparing Present Count vs. Past Count

Slope for Trend

Find Outliers

Predict Future Counts (Recession Predict is Jack Coate’s idea)

There’s a Donut Chart (Ron Naken’s Module) that allows you to split your list of keywords by top 10 host, source, or sourcetypes and see the distribution of events.

Split Keyword(s) Distribution by Top 10 Hosts, Source, or Sourcetype

Here are rare events based on your filter:

Rare

Finally, here are rare events based on punctuation.

Punct

Conclusion

Hopefully, this template will satisfy all your needs out of the box. If you need to modify the searches, make a copy of the app’s default/data/ui/views/<dashboard>.xml file and put it into the app’s local/data/ui/views/<dashboard>.xml file and edit your local copy. I’m hoping this app will save you some time from configuring these common tasks.

/en_us/blog/fragments/digital-resilience-pays-off
Style
two-column

Related Articles

Your Roadmap to Success with Risk-Based Alerting
Security
4 Minute Read

Your Roadmap to Success with Risk-Based Alerting

Splunker Haylee Mills dives deeper into the four levels of the Splunk Risk-Based Alerting journey.
Model-Assisted Threat Hunting (M-ATH) with the PEAK Framework
Security
9 Minute Read

Model-Assisted Threat Hunting (M-ATH) with the PEAK Framework

Welcome to the third entry in our introduction to the PEAK Threat Hunting Framework! Taking our detective theme to the next level, imagine a tough case where you need to call in a specialized investigator. For these unique cases, we can use algorithmically-driven approaches called Model-Assisted Threat Hunting (M-ATH).
Trust Unearned? Evaluating CA Trustworthiness Across 5 Billion Certificates
Security
10 Minute Read

Trust Unearned? Evaluating CA Trustworthiness Across 5 Billion Certificates

In this blog post, we dive into our recent research project, in which the Splunk SURGe team analyzed more than five billion TLS certificates to find out if the CAs we rely on are really worthy of our trust.
Splunk Field Hashing & Masking Capabilities for Compliance
Security
3 Minute Read

Splunk Field Hashing & Masking Capabilities for Compliance

Satisfy internal and external compliance requirements using Splunk standard components.
Security Content from the Splunk Threat Research Team
Security
5 Minute Read

Security Content from the Splunk Threat Research Team

The blog explains how STRT develops Splunk Security Content, aiding detection engineering and threat research teams to efficiently detect and respond to potential threats, using ESCU App amidst growing security incidents and system complexity.
Hypothesis-Driven Hunting with the PEAK Framework
Security
9 Minute Read

Hypothesis-Driven Hunting with the PEAK Framework

Details on hypothesis-driven threat hunting with the PEAK framework.
Planning for Success with Risk-Based Alerting
Security
4 Minute Read

Planning for Success with Risk-Based Alerting

In our last RBA blog post, we talked about some of the problems RBA can help solve. In this post, we explain the methodology we use with Splunk customers as their security teams start working with RBA.
Machine Learning in Security: Detect Suspicious TXT Records Using Deep Learning
Security
8 Minute Read

Machine Learning in Security: Detect Suspicious TXT Records Using Deep Learning

The Splunk Machine Learning for Security (SMLS) team introduces a new detection to detect DNS Tunneling using DNS TXT payloads.
7 questions all CxOs should ask to increase cyber resilience before buying more software
Security
7 Minute Read

7 questions all CxOs should ask to increase cyber resilience before buying more software

Here are 7 questions you should always ask to help your organisation to make the best possible purchase and increase its cyber resilience at the same time.
/en_us/blog/fragments/about-splunk
/en_us/blog/fragments/subscribe-footer