topic Splunk Anomaly Detection for Logs in Alerting

Splunk Anomaly Detection for Logs

maheswar6523 — Fri, 29 Jun 2018 07:23:27 GMT

Team,

Are there any working sample to create a POC on Splunk Anomaly Detection using Logs messages.
In our senario we need to notify admin if any login failure /Error received we need to notify an alert.

Thanks
Uma

Re: Splunk Anomaly Detection for Logs

niketn — Fri, 29 Jun 2018 12:29:15 GMT

Two of the Starting points would be

1) Machine Learning Toolkit App
2) Splunk Security Essentials App

Some of the good blocks to read:
1) Anomaly Detection with Splunk IT Service Intelligence and Machine Learning Toolkit v3.2 series
2) Hunting With Splunk Series
3) Advanced Statistics Splunk Documentation