New Keyword App

One of the most common requests I get from new customers is that they want to centrally collect all their machine generated time series data and search for a keyword like error or RuntimeException. Obviously Splunk can do this. Then, the next set of questions concern things like give me the top hosts or applications producing this keyword, show me a baseline of last week vs this week for this keyword, show me a slope line on the trend for this or any keyword(s), find outliers that go beyond the average occurrences for the keyword and then try to predict what may happen in the future.

To answer these questions and then some, I’ve created an app template that you can download from Splunkbase and simply install the Keyword App. The app has no inputs as it uses your own indexed data. You can modify the default indexes for the role that uses the app in Manager to include indexes beyond main. Usually, what I do next in these blog entries is describe how to use the app. However, in this case, a picture is worth a thousand words. Rather than continue to entertain you with my prose, I’ll simply embed the the self explanatory dashboards here.

Top Host, Sourcetype, Source

Top Host, Sourcetype, and Source for Keyword

Comparing Present Count vs. Past Count

Slope for Trend

Find Outliers

Predict Future Counts (Recession Predict is Jack Coate’s idea)

There’s a Donut Chart (Ron Naken’s Module) that allows you to split your list of keywords by top 10 host, source, or sourcetypes and see the distribution of events.

Split Keyword(s) Distribution by Top 10 Hosts, Source, or Sourcetype

Here are rare events based on your filter:

Rare

Finally, here are rare events based on punctuation.

Punct

Conclusion

Hopefully, this template will satisfy all your needs out of the box. If you need to modify the searches, make a copy of the app’s default/data/ui/views/<dashboard>.xml file and put it into the app’s local/data/ui/views/<dashboard>.xml file and edit your local copy. I’m hoping this app will save you some time from configuring these common tasks.

/en_us/blog/fragments/digital-resilience-pays-off
Style
two-column

Related Articles

Staff Picks for Splunk Security Reading August 2023
Security
4 Minute Read

Staff Picks for Splunk Security Reading August 2023

Splunk security experts share a list of presentations, whitepapers, and customer case studies from August 2023 that they feel are worth a read.
Splunk Security Use Cases
Security
2 Minute Read

Splunk Security Use Cases

Key Threat Hunting Deliverables with PEAK
Security
4 Minute Read

Key Threat Hunting Deliverables with PEAK

When most people think of threat hunting, they think of uncovering unknown threats – but that is only one of many (better) reasons to show value with threat hunting.
Unified Strategies Across IT and Security for Cutting-Edge Detection, Investigation and Response
Security
4 Minute Read

Unified Strategies Across IT and Security for Cutting-Edge Detection, Investigation and Response

Splunk's Mike Horn shares a closer look at the value of a unified approach to security and observability.
Detecting Lateral Movement Using Splunk User Behavior Analytics
Security
8 Minute Read

Detecting Lateral Movement Using Splunk User Behavior Analytics

The blog is to introduce lateral movement detection using Splunk User Behavior Analytics (UBA)
Integrated Intelligence Enrichment With Threat Intelligence Management
Security
1 Minute Read

Integrated Intelligence Enrichment With Threat Intelligence Management

Threat Intelligence Management enables analysts to fully investigate security events or suspicious activity by providing the relevant and normalized intelligence to better understand threat context and accelerate time to triage.
Splunk SOAR Playbook of the Month: Investigations with Playbooks
Security
2 Minute Read

Splunk SOAR Playbook of the Month: Investigations with Playbooks

For this month’s edition of Playbook of the Month, we’ll look at how you can perform investigations at machine speed using Splunk SOAR and one of our investigation playbooks, Internal Host WinRM Investigate.
Using Splunk Stream for Hunting: Finding Islands in the Stream (of Data)
Security
4 Minute Read

Using Splunk Stream for Hunting: Finding Islands in the Stream (of Data)

Let's look at how to use the popular Splunk Stream App for our favorite purpose: threat hunting! This is part of our Threat Hunting with Splunk series.
That Was Easy! Manage Lookup Files and Backups With the Splunk App for Lookup File Editing
Security
2 Minute Read

That Was Easy! Manage Lookup Files and Backups With the Splunk App for Lookup File Editing

The 4.0.1 release of the App for Lookup File Editing helps users mitigate issues with new features such as a backup size limit and dashboards for tracking backup size.
/en_us/blog/fragments/about-splunk
/en_us/blog/fragments/subscribe-footer