Archive

How to do log analysis using splunk

New Member

I am working on approach to upload logs to splunk,I have set of queries to query in logs and extract the values.How to run queries as soon as one user uploads logs without himself querying and give him the results

0 Karma

SplunkTrust
SplunkTrust

Hi @srinivas0704,
you could create an alert, running e.g. every five minutes that checks logs upload and send an email with the results.
the problem is: how many users do you have for this job? if they are a limited number you could create an alert for each one with his email, if they are many is more difficoult.

ciao.
Giuseppe

0 Karma

New Member

@gcusello Thanks for looking into, there are many. Is there some way when user uploads the logs it does all the queries automatically and show result

0 Karma

SplunkTrust
SplunkTrust

Hi @srinivas0704,
you could create a dashboard that displays all the data in an index, but the user should insert some parameters to find the uploaded logs (e.g. source or index or sourcetype).

One question: when you speak of log upload, are you speaking of the UI guided procedure?
if yes at the end of the procedure Splunk shows a button to display all the loaded events.

ciao.
Giuseppe

0 Karma

New Member

@gcusello Log upload is about application logs which user uploads himself and he should get to know whats the issue on uploading logs

0 Karma

SplunkTrust
SplunkTrust

Hi @srinivas0704,
as i said, at the end of the UI guided procedure user has a button to display all the loaded events.

ciao.
Giuseppe

0 Karma

SplunkTrust
SplunkTrust
0 Karma

New Member

@gcusello Thanks will refer this

0 Karma

New Member

@gcusello Checked the video but they are still querying. Sry if I am not clear. I have a list of queries which should be executed on each and every logs user uploads and give results to them of queries executed

0 Karma

SplunkTrust
SplunkTrust

The only way is to create more alert with all your queries and send results to you users, otherwise, they can access results in alerts.
Ciao.
Giuseppe

0 Karma

New Member

ok will check this,thanks @gcusello

0 Karma

New Member

@gcusello Do you have any guide on how to load the events so that it displays all the loaded events or queries

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!