New Keyword App

One of the most common requests I get from new customers is that they want to centrally collect all their machine generated time series data and search for a keyword like error or RuntimeException. Obviously Splunk can do this. Then, the next set of questions concern things like give me the top hosts or applications producing this keyword, show me a baseline of last week vs this week for this keyword, show me a slope line on the trend for this or any keyword(s), find outliers that go beyond the average occurrences for the keyword and then try to predict what may happen in the future.

To answer these questions and then some, I’ve created an app template that you can download from Splunkbase and simply install the Keyword App. The app has no inputs as it uses your own indexed data. You can modify the default indexes for the role that uses the app in Manager to include indexes beyond main. Usually, what I do next in these blog entries is describe how to use the app. However, in this case, a picture is worth a thousand words. Rather than continue to entertain you with my prose, I’ll simply embed the the self explanatory dashboards here.

Top Host, Sourcetype, Source

Top Host, Sourcetype, and Source for Keyword

Comparing Present Count vs. Past Count

Slope for Trend

Find Outliers

Predict Future Counts (Recession Predict is Jack Coate’s idea)

There’s a Donut Chart (Ron Naken’s Module) that allows you to split your list of keywords by top 10 host, source, or sourcetypes and see the distribution of events.

Split Keyword(s) Distribution by Top 10 Hosts, Source, or Sourcetype

Here are rare events based on your filter:

Rare

Finally, here are rare events based on punctuation.

Punct

Conclusion

Hopefully, this template will satisfy all your needs out of the box. If you need to modify the searches, make a copy of the app’s default/data/ui/views/<dashboard>.xml file and put it into the app’s local/data/ui/views/<dashboard>.xml file and edit your local copy. I’m hoping this app will save you some time from configuring these common tasks.

/en_us/blog/fragments/digital-resilience-pays-off
Style
two-column

Related Articles

Amadey Threat Analysis and Detections
Security
8 Minute Read

Amadey Threat Analysis and Detections

The Splunk Threat Research Team shares a deep-dive analysis of the Amadey Trojan Stealer, an active and prominent malware that first emerged on the cybersecurity landscape in 2018 and has maintained a persistent botnet infrastructure ever since.
DevSecOps is Here! Developers and SREs, Meet the SOC Team.
Security
2 Minute Read

DevSecOps is Here! Developers and SREs, Meet the SOC Team.

As organizations strive to enhance the cyber resilience of their operations, the scope of SOC teams is expanding beyond traditional enterprise IT. Find out more in this blog.
Splunk SOAR Playbook of the Month: Threat Hunting with Playbooks
Security
2 Minute Read

Splunk SOAR Playbook of the Month: Threat Hunting with Playbooks

For this month’s edition of Playbook of the Month, we’ll look at how you can use Splunk SOAR’s Hunting playbook to perform threat hunting activities at machine speed.
Baseline Hunting with the PEAK Framework
Security
9 Minute Read

Baseline Hunting with the PEAK Framework

Splunker David Bianco provides an in-depth look at baseline hunts, also known as Exploratory Data Analysis (EDA) hunts.
Machine Learning in Security: Detect DNS Data Exfiltration Using Deep Learning
Security
8 Minute Read

Machine Learning in Security: Detect DNS Data Exfiltration Using Deep Learning

This blog discusses in detail about detecting DNS data exfiltration attacks using deep learning
Peeping Through Windows (Logs): Using Sysmon & Event Codes for Threat Hunting
Security
12 Minute Read

Peeping Through Windows (Logs): Using Sysmon & Event Codes for Threat Hunting

Windows and endpoints go together like threat hunting and Splunk. Let's look at the most valuable Sysmon event codes for threat hunting in Splunk.
UK TSA Regulations: SOC Teams, Get Ready!
Security
7 Minute Read

UK TSA Regulations: SOC Teams, Get Ready!

The UK Telecommunications Security Act (TSA) compliance is coming and will be a new challenge for SOC teams. Splunk security evangelist Matthias Maier takes a closer look at requirements and shares an end-to-end use case as an example.
Staff Picks for Splunk Security Reading June 2023
Security
5 Minute Read

Staff Picks for Splunk Security Reading June 2023

Hello, everyone! Welcome to the Splunk staff picks blog. Each month, Splunk security experts curate a list of presentations, whitepapers, and customer case studies that we feel are worth a read.
Threat Hunting with Splunk: Hands-on Tutorials for the Active Hunter
Security
4 Minute Read

Threat Hunting with Splunk: Hands-on Tutorials for the Active Hunter

Curious about threat hunting in Splunk? Wanna brush up on your baddie-finding skills? Here's the place to find every one of our expert articles for hunting with Splunk.
/en_us/blog/fragments/about-splunk
/en_us/blog/fragments/subscribe-footer