https://community.splunk.com/t5/Reporting/Splunk-data-logs-spreadsheet/m-p/192780#M10656 <P>Knowing this level of data requires you to enhance the data with Splunk asset lookups. The simplest approach is to say:</P> <PRE><CODE>|tstats count by sourcetype source host </CODE></PRE> <P>This will give you a count by each piece of metadata, most of which clue you in to what the data is. For example, <CODE>access_combined</CODE> is a default standard for Apache Web logs. <CODE>WinEventLog:Security</CODE> is the Windows Security log. If you need to go deeper than that, you will have to tell Splunk (via lookup) what each host in the environment is, what it does, etc....</P> Mon, 06 Jul 2015 12:51:22 GMT alacercogitatus 2015-07-06T12:51:22Z https://community.splunk.com/t5/Reporting/Splunk-data-logs-spreadsheet/m-p/192779#M10655 <P>I'm new to Splunk - and have been asked to create a spreadsheet that my global company can use to baseline our Proof of Concept (POC), <BR /> Specifically, how do you identify what you are forwarding e.g. if I wanted to identify specific machines what is the best approach .....to identify the log type or the machine type?????? Would the below be the best approach???? </P> <P>And then add for example "firewall with IPS" Under "Security" ???<BR /> Or "Cisco switch" under "network"?</P> <P>Security | Custom Applications | Networks | databases | Servers | Smartphones | Virtual Machines | Web Services | Sensors</P> Fri, 03 Jul 2015 22:57:39 GMT https://community.splunk.com/t5/Reporting/Splunk-data-logs-spreadsheet/m-p/192779#M10655 tacobell 2015-07-03T22:57:39Z https://community.splunk.com/t5/Reporting/Splunk-data-logs-spreadsheet/m-p/192780#M10656 <P>Knowing this level of data requires you to enhance the data with Splunk asset lookups. The simplest approach is to say:</P> <PRE><CODE>|tstats count by sourcetype source host </CODE></PRE> <P>This will give you a count by each piece of metadata, most of which clue you in to what the data is. For example, <CODE>access_combined</CODE> is a default standard for Apache Web logs. <CODE>WinEventLog:Security</CODE> is the Windows Security log. If you need to go deeper than that, you will have to tell Splunk (via lookup) what each host in the environment is, what it does, etc....</P> Mon, 06 Jul 2015 12:51:22 GMT https://community.splunk.com/t5/Reporting/Splunk-data-logs-spreadsheet/m-p/192780#M10656 alacercogitatus 2015-07-06T12:51:22Z