topic Re: Interesting fields/values , MLTK, etc in Splunk Search

Interesting fields/values , MLTK, etc

inventsekar — Wed, 28 Oct 2020 05:27:19 GMT

Hi All,

I got a bunch of logs, from which I would like get some business values. Using with or without MLTK.

I would like to create some dashboards from these 100k log events.

- some interesting fields, field values, etc

- the most famous, least famous patterns, etc

- some good transactions (longest/shortest, etc)

I read some use cases of MLTK, but, being a newbie to MLTK, i could not get something out of it. Searching on google also.

Thanks for any suggestion/printers/views, anything.

Best Regards,

Sekar

Re: Interesting fields/values , MLTK, etc

richgalloway — Wed, 28 Oct 2020 13:27:06 GMT

Machine Learning is one of the industry's favorite buzzwords lately, but you don't know what to do with it then chances are you don't need it. Your examples can be accomplished fairly easily with SPL.

Feel free to ask specific questions about your MLTK use cases, however.

Re: Interesting fields/values , MLTK, etc

inventsekar — Wed, 28 Oct 2020 13:51:25 GMT

Thanks @richgalloway .. sure, i got your view, basic SPL is enough.
But, i thought someone may give me some suggestions, ok, let me wait for their MLTK suggestions.

meanwhile, i would like to find out:

- some good transactions (longest/shortest, etc) - these are audit logs, which got connection established, disconnected msgs. so, pls suggest how to find the longest connection(i think by using transaction it will be easy).

Re: Interesting fields/values , MLTK, etc

richgalloway — Wed, 28 Oct 2020 14:47:25 GMT

This is difficult to answer without knowing more about your data. The transaction command may be easy to use, but it usually is very slow. Something like "| stats range(_time) as duration by session_id" may work better.