Getting Data In

Retrieve output data from Splunk

JosIJntema
Explorer

Hi there,

We want to get data from Splunk after a Splunk search has outputted the data in a file.

Case
In Splunk we have events for each user. With these events we can categorise users in target groups. What we can do is make an output everyday where the users are updated and for each user id the target group is saved.

How could I then query this information from for example a website?

Is this a good use of Splunk? Is there another solution that better solves what I want to achieve?

Thanks!

Tags (1)
0 Karma

woodcock
Esteemed Legend

You are describing Summary Indexing; read all about it here:

https://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Usesummaryindexing

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi JosIJntema,
Yes, you can extract the number of events for each user, export results in a file and then categorize results in Excel.
to write the result of a Splunk search you can add at the end of your search the outputcsv command (see http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Outputcsv).
Remember that the folder where you can find csv files is fixed: $SPLUNK_HOME/var/run/splunk/csv

But I'd prefer to do the same categorization adding to your app a lookup containing users and categories, in this way you can create a report with categories, users and the number of events for each user.
You have many advantages of this methis:

  • you'll use only one tool to create your report;
  • you don't need to do manual operations on results;
  • in addition, you can also verify if someone of your users hasn't events.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...