Reporting

Splunk data logs spreadsheet

tacobell
New Member

I'm new to Splunk - and have been asked to create a spreadsheet that my global company can use to baseline our Proof of Concept (POC),
Specifically, how do you identify what you are forwarding e.g. if I wanted to identify specific machines what is the best approach .....to identify the log type or the machine type?????? Would the below be the best approach????

And then add for example "firewall with IPS" Under "Security" ???
Or "Cisco switch" under "network"?

Security | Custom Applications | Networks | databases | Servers | Smartphones | Virtual Machines | Web Services | Sensors

Tags (1)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Knowing this level of data requires you to enhance the data with Splunk asset lookups. The simplest approach is to say:

|tstats count by sourcetype source host

This will give you a count by each piece of metadata, most of which clue you in to what the data is. For example, access_combined is a default standard for Apache Web logs. WinEventLog:Security is the Windows Security log. If you need to go deeper than that, you will have to tell Splunk (via lookup) what each host in the environment is, what it does, etc....

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...