Splunk App for NLP

[swdowiarz]

Hi

I have a question. I'm using splunk for bot logs monitoring and I'm looking for a app or anything else which can help with specific problem. I'll have file with banned words and I want to check if any of those words from file are appearing in logs. If yes I need to set alert or something like this. Is there any app which can help mi with this ? I would be grateful for your help.

[andrey2007]

You can create a lookup with banned words named stop_words.csv and use it as condition for your search
somethink like this
your_search [| inputlookup stop_words.csv | return 10 $banned_words]

[swdowiarz]

but if I change the file with banned words, will my lookup change as well or I'll have to do it on my own ?

[andrey2007]

you can change lookup manually but better on my mind create a scheduled search which will populate your lookup using outputlookup command

[swdowiarz]

I have other question, how it would affect to performance of splunk ? or this is best solution ?

[niketn]

@swdowiarz, if you want to write the Splunk search on your own to find the occurrences of banned words present in your sample file vs the indexed BOT logs, this should be straight forward with plenty of data correlation and enrichment functionalities available in Splunk (simple starting point could be uploading banned words as lookup or may be index banned words as well to Splunk and correlate). Refer to following Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation

Also while I have not used the apps you can try checking out the following;

1) Widzee Natural Language Analytics for Splunk: http://wizdee.com/home/splunk-natural-language/
2) Sentiment Analysis Splunk App: https://splunkbase.splunk.com/app/1179/#/details