New Keyword App

One of the most common requests I get from new customers is that they want to centrally collect all their machine generated time series data and search for a keyword like error or RuntimeException. Obviously Splunk can do this. Then, the next set of questions concern things like give me the top hosts or applications producing this keyword, show me a baseline of last week vs this week for this keyword, show me a slope line on the trend for this or any keyword(s), find outliers that go beyond the average occurrences for the keyword and then try to predict what may happen in the future.

To answer these questions and then some, I’ve created an app template that you can download from Splunkbase and simply install the Keyword App. The app has no inputs as it uses your own indexed data. You can modify the default indexes for the role that uses the app in Manager to include indexes beyond main. Usually, what I do next in these blog entries is describe how to use the app. However, in this case, a picture is worth a thousand words. Rather than continue to entertain you with my prose, I’ll simply embed the the self explanatory dashboards here.

Top Host, Sourcetype, Source

Top Host, Sourcetype, and Source for Keyword

Comparing Present Count vs. Past Count

Slope for Trend

Find Outliers

Predict Future Counts (Recession Predict is Jack Coate’s idea)

There’s a Donut Chart (Ron Naken’s Module) that allows you to split your list of keywords by top 10 host, source, or sourcetypes and see the distribution of events.

Split Keyword(s) Distribution by Top 10 Hosts, Source, or Sourcetype

Here are rare events based on your filter:

Rare

Finally, here are rare events based on punctuation.

Punct

Conclusion

Hopefully, this template will satisfy all your needs out of the box. If you need to modify the searches, make a copy of the app’s default/data/ui/views/<dashboard>.xml file and put it into the app’s local/data/ui/views/<dashboard>.xml file and edit your local copy. I’m hoping this app will save you some time from configuring these common tasks.

/en_us/blog/fragments/digital-resilience-pays-off
Style
two-column

Related Articles

Deep Dive on Persistence, Privilege Escalation Technique and Detection in Linux Platform
Security
10 Minute Read

Deep Dive on Persistence, Privilege Escalation Technique and Detection in Linux Platform

Deep dive with the Splunk Threat Research Team on Linux Privilege Escalation and Linux Persistence Techniques.
Linux Persistence and Privilege Escalation: Threat Research January 2022 Release
Security
6 Minute Read

Linux Persistence and Privilege Escalation: Threat Research January 2022 Release

In this January 2022 release, The Splunk Threat Research (STRT) team focused on the recently released Sysmon for Linux technology addition to Splunk.
Staff Picks for Splunk Security Reading February 2022
Security
2 Minute Read

Staff Picks for Splunk Security Reading February 2022

Each month, Splunk security experts curate a list of news articles, research, white papers, and customer case studies that we feel are worth a read. We hope you enjoy!
Introducing Synthetic Adversarial Log Objects (SALO)
Security
2 Minute Read

Introducing Synthetic Adversarial Log Objects (SALO)

Synthetic Adversarial Log Objects (SALO) is a framework for the generation of log events without the need for infrastructure or actions to initiate the event that causes a log event. Learn more about its purpose and how you can utilize it.
Staff Picks for Splunk Security Reading January 2022
Security
2 Minute Read

Staff Picks for Splunk Security Reading January 2022

Welcome to the Splunk staff picks blog. Each month, Splunk security experts select presentations, white papers, and customer case studies that we feel are worth a read. We hope you enjoy.
Threat Advisory: STRT-TA02 - Destructive Software
Security
11 Minute Read

Threat Advisory: STRT-TA02 - Destructive Software

The focus of this threat advisory is on a recently reported destructive payload by Microsoft MSTIC under the name of WhisperGate. We break down the different components and functions of how this payload works and provide a series of detections to mitigate and defend against this threat.
Approaching Linux Post-Exploitation with Splunk Attack Range
Security
7 Minute Read

Approaching Linux Post-Exploitation with Splunk Attack Range

An introduction to linux post exploitation simulation and threat detection using Splunk Attack Range and linux Sysmon.
Refined User Experience, New Executive Visibility, and Enhanced Cloud Monitoring with Splunk Enterprise Security 7.0
Security
3 Minute Read

Refined User Experience, New Executive Visibility, and Enhanced Cloud Monitoring with Splunk Enterprise Security 7.0

Check out the latest Security Analytics enhancements to Splunk Enterprise Security with our latest 7.0 release.
Detecting Malware Script Loaders using Remcos: Threat Research Release December 2021
Security
9 Minute Read

Detecting Malware Script Loaders using Remcos: Threat Research Release December 2021

Start detection against behaviors and TTPs from a Remcos loader that utilizes DynamicWrapperX (dynwrapx.dll) to execute shellcode and inject Remcos RAT into the target process.
/en_us/blog/fragments/about-splunk
/en_us/blog/fragments/subscribe-footer