topic Re: How to do log analysis using splunk in Splunk Search

How to do log analysis using splunk

srinivas0704 — Thu, 14 May 2020 11:33:11 GMT

I am working on approach to upload logs to splunk,I have set of queries to query in logs and extract the values.How to run queries as soon as one user uploads logs without himself querying and give him the results

Re: How to do log analysis using splunk

gcusello — Thu, 14 May 2020 12:45:46 GMT

Hi @srinivas0704,
you could create an alert, running e.g. every five minutes that checks logs upload and send an email with the results.
the problem is: how many users do you have for this job? if they are a limited number you could create an alert for each one with his email, if they are many is more difficoult.

ciao.
Giuseppe

Re: How to do log analysis using splunk

srinivas0704 — Thu, 14 May 2020 12:48:17 GMT

@gcusello Thanks for looking into, there are many. Is there some way when user uploads the logs it does all the queries automatically and show result

Re: How to do log analysis using splunk

gcusello — Thu, 14 May 2020 12:57:13 GMT

Hi @srinivas0704,
you could create a dashboard that displays all the data in an index, but the user should insert some parameters to find the uploaded logs (e.g. source or index or sourcetype).

One question: when you speak of log upload, are you speaking of the UI guided procedure?
if yes at the end of the procedure Splunk shows a button to display all the loaded events.

ciao.
Giuseppe

Re: How to do log analysis using splunk

srinivas0704 — Thu, 14 May 2020 13:15:53 GMT

@gcusello Log upload is about application logs which user uploads himself and he should get to know whats the issue on uploading logs

Re: How to do log analysis using splunk

gcusello — Thu, 14 May 2020 13:30:43 GMT

Hi @srinivas0704,
as i said, at the end of the UI guided procedure user has a button to display all the loaded events.

ciao.
Giuseppe

Re: How to do log analysis using splunk

srinivas0704 — Thu, 14 May 2020 14:19:49 GMT

@gcusello Do you have any guide on how to load the events so that it displays all the loaded events or queries

Re: How to do log analysis using splunk

gcusello — Thu, 14 May 2020 14:24:21 GMT

Hi @srinivas0704,
see these:
https://www.youtube.com/watch?v=3GKhCZfQqDM
https://dev.splunk.com/enterprise/tutorials/quickstart/adddata

Ciao.
Giuseppe

Re: How to do log analysis using splunk

srinivas0704 — Thu, 14 May 2020 14:50:39 GMT

@gcusello Thanks will refer this

Re: How to do log analysis using splunk

srinivas0704 — Thu, 14 May 2020 14:57:57 GMT

@gcusello Checked the video but they are still querying. Sry if I am not clear. I have a list of queries which should be executed on each and every logs user uploads and give results to them of queries executed

Re: How to do log analysis using splunk

gcusello — Thu, 14 May 2020 15:00:37 GMT

The only way is to create more alert with all your queries and send results to you users, otherwise, they can access results in alerts.
Ciao.
Giuseppe

Re: How to do log analysis using splunk

srinivas0704 — Thu, 14 May 2020 15:02:58 GMT

ok will check this,thanks @gcusello