topic Re: Using Splunk as a real-time event detection engine in Splunk Search

Using Splunk as a real-time event detection engine

jsash1 — Mon, 05 Aug 2013 01:10:47 GMT

Hi,

I have a requirement for an event detection engine which is able to identify a string (e.g. username) in a particular data source and 'notify' other systems that the event has occurred.

I appreciate the inherent flexibility Splunk has by allowing Scripts to be used in conjunction with Alerts to achive this, but i wanted to see if anyone is using Splunk within a large enterprise Production environment as an event detection engine (instead of just a data visualisation tool)?

Once the event has occurred, Splunk will need to 'notify' other systems by sending a JMS message to one system and updating a database table in another system. How suitable is the scripting capability in Splunk for run-time requirements like this?

Cheers,
James.

Re: Using Splunk as a real-time event detection engine

billford — Mon, 05 Aug 2013 01:24:07 GMT

Yes. All the time. What is your specific question?

Re: Using Splunk as a real-time event detection engine

jsash1 — Mon, 05 Aug 2013 01:26:15 GMT

Re: Using Splunk as a real-time event detection engine

billford — Mon, 05 Aug 2013 01:30:31 GMT

Sorry reading it on my phone, overlooked the actual question. Yes that should be no problem. You can script with pretty much anything. I generally use python or bash but to each his/her own. :). We often use external alerting to send an ip to a firewall to be dropped or to update a blacklist, etc. Same principle.