topic Re: Programming business rules inside Splunk in Reporting

Programming business rules inside Splunk

fduprat — Fri, 25 Mar 2011 19:16:55 GMT

Is it possible to program some special consolidation inside Splunk?

For example: I want to run trough all log lines, ordered by id_user and date. For each 30 minutes a user navigate on my site, I count one visitor session, except for IPs inside a black list.

Is Splunk made for it?

Re: Programming business rules inside Splunk

netwrkr — Fri, 25 Mar 2011 19:28:56 GMT

Splunk can do just about anything provided you know how to write the search query. Take a look at the 'transaction' command - I believe it is what you seek -

http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction

Re: Programming business rules inside Splunk

fduprat — Fri, 25 Mar 2011 19:45:49 GMT

Thank you! I will take a look.

Re: Programming business rules inside Splunk

fduprat — Fri, 25 Mar 2011 20:05:26 GMT

This works fine, but I must always use that query-like structure inside Splunk?

Can I do some kink of structured programming inside Splunk?

Can I use Java inside Splunk?

Re: Programming business rules inside Splunk

southeringtonp — Fri, 25 Mar 2011 20:33:53 GMT

Splunk is pretty flexible. Take a look at lookup tables and custom search commands.

Lookup tables allow you to add new fields based on existing ones. Typically you'll use a CSV file, but you can also us custom Python code. Take a look at the earlier question about Using CIDR in a lookup table for more ideas.

Custom search commands allow you to take things further, and process search results almost any way you want. Again, these would be written in Python. For more information, look here and here.

For your example case, a lookup is the way to go. If you are blacklisting individual IP addresses, create a CSV-based lookup with two fields src_ip and blacklisted, then search for, e.g., blacklisted=1. If you want to use network ranges instead, try the subnet lookup script referenced here or use eventtypes.

Re: Programming business rules inside Splunk

fox — Fri, 25 Mar 2011 23:38:07 GMT

have a try with: summary indexing and search macros