All Apps and Add-ons

Splunk App for NLP

swdowiarz
Path Finder

Hi

I have a question. I'm using splunk for bot logs monitoring and I'm looking for a app or anything else which can help with specific problem. I'll have file with banned words and I want to check if any of those words from file are appearing in logs. If yes I need to set alert or something like this. Is there any app which can help mi with this ? I would be grateful for your help.

0 Karma

andrey2007
Contributor

You can create a lookup with banned words named stop_words.csv and use it as condition for your search
somethink like this
your_search [| inputlookup stop_words.csv | return 10 $banned_words]

0 Karma

swdowiarz
Path Finder

but if I change the file with banned words, will my lookup change as well or I'll have to do it on my own ?

0 Karma

andrey2007
Contributor

you can change lookup manually but better on my mind create a scheduled search which will populate your lookup using outputlookup command

0 Karma

swdowiarz
Path Finder

I have other question, how it would affect to performance of splunk ? or this is best solution ?

0 Karma

niketn
Legend

@swdowiarz, if you want to write the Splunk search on your own to find the occurrences of banned words present in your sample file vs the indexed BOT logs, this should be straight forward with plenty of data correlation and enrichment functionalities available in Splunk (simple starting point could be uploading banned words as lookup or may be index banned words as well to Splunk and correlate). Refer to following Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation

Also while I have not used the apps you can try checking out the following;

1) Widzee Natural Language Analytics for Splunk: http://wizdee.com/home/splunk-natural-language/
2) Sentiment Analysis Splunk App: https://splunkbase.splunk.com/app/1179/#/details

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...