New Keyword App

One of the most common requests I get from new customers is that they want to centrally collect all their machine generated time series data and search for a keyword like error or RuntimeException. Obviously Splunk can do this. Then, the next set of questions concern things like give me the top hosts or applications producing this keyword, show me a baseline of last week vs this week for this keyword, show me a slope line on the trend for this or any keyword(s), find outliers that go beyond the average occurrences for the keyword and then try to predict what may happen in the future.

To answer these questions and then some, I’ve created an app template that you can download from Splunkbase and simply install the Keyword App. The app has no inputs as it uses your own indexed data. You can modify the default indexes for the role that uses the app in Manager to include indexes beyond main. Usually, what I do next in these blog entries is describe how to use the app. However, in this case, a picture is worth a thousand words. Rather than continue to entertain you with my prose, I’ll simply embed the the self explanatory dashboards here.

Top Host, Sourcetype, Source

Top Host, Sourcetype, and Source for Keyword

Comparing Present Count vs. Past Count

Slope for Trend

Find Outliers

Predict Future Counts (Recession Predict is Jack Coate’s idea)

There’s a Donut Chart (Ron Naken’s Module) that allows you to split your list of keywords by top 10 host, source, or sourcetypes and see the distribution of events.

Split Keyword(s) Distribution by Top 10 Hosts, Source, or Sourcetype

Here are rare events based on your filter:

Rare

Finally, here are rare events based on punctuation.

Punct

Conclusion

Hopefully, this template will satisfy all your needs out of the box. If you need to modify the searches, make a copy of the app’s default/data/ui/views/<dashboard>.xml file and put it into the app’s local/data/ui/views/<dashboard>.xml file and edit your local copy. I’m hoping this app will save you some time from configuring these common tasks.

/en_us/blog/fragments/digital-resilience-pays-off
Style
two-column

Related Articles

Staff Picks for Splunk Security Reading September 2023
Security
3 Minute Read

Staff Picks for Splunk Security Reading September 2023

Our Splunk security experts curated their September 2023 list of presentations, whitepapers, and customer case studies that we feel are worth a read.
Revisiting the Big Picture: Macro-level ATT&CK Updates for 2023
Security
5 Minute Read

Revisiting the Big Picture: Macro-level ATT&CK Updates for 2023

SURGe reviews the latest attacker trends and behaviors with this look at four years of ATT&CK data from some of the largest and most trusted threat reporting sources.
Defending the Gates: Understanding and Detecting Ave Maria (Warzone) RAT
Security
8 Minute Read

Defending the Gates: Understanding and Detecting Ave Maria (Warzone) RAT

The Splunk Threat Research Team provides a deep-dive analysis of Ave Maria RAT, also known as 'Warzone RAT.'
Mockbin and the Art of Deception: Tracing Adversaries, Going Headless and Mocking APIs
Security
9 Minute Read

Mockbin and the Art of Deception: Tracing Adversaries, Going Headless and Mocking APIs

Splunk's Threat Research Team delves into the attack's components, usage of tools like Mockbin and headless browsers, and provides guidance on detecting such activities.
Using metadata & tstats for Threat Hunting
Security
4 Minute Read

Using metadata & tstats for Threat Hunting

Behold the power of metadata and tstats commands! These commands will quickly provide situational awareness of your hosts and sourcetypes as you begin hunting.
Using stats, eventstats & streamstats for Threat Hunting…Stat!
Security
5 Minute Read

Using stats, eventstats & streamstats for Threat Hunting…Stat!

The stats command is a crucial capability when you’re threat hunting. And so are two related commands: eventstats & streamstats. Get all the details, right here.
Threat Hunting for Dictionary-DGA with PEAK
Security
6 Minute Read

Threat Hunting for Dictionary-DGA with PEAK

Explore applied model-assisted threat hunting for dictionary-based domain generation algorithms using the SURGe Security Research Team's PEAK Threat Hunting Framework.
Deep Learning in Security: Text-based Phishing Email Detection with BERT Model
Security
4 Minute Read

Deep Learning in Security: Text-based Phishing Email Detection with BERT Model

We introduced a large language model (LLM)-based phishing email detector integrated into the Splunk DSDL app. We provide details on model training and evaluation, comparisons to other machine learning and deep learning algorithms as well as deployment approaches to Splunk in this blog.
Sharing is Not Caring: Hunting for Network Share Discovery
Security
9 Minute Read

Sharing is Not Caring: Hunting for Network Share Discovery

This post offers a practical guide to enhancing detection strategies against network share discovery, a technique often used by threat actors.
/en_us/blog/fragments/about-splunk
/en_us/blog/fragments/subscribe-footer