Reporting
Highlighted

Programming business rules inside Splunk

Explorer

Is it possible to program some special consolidation inside Splunk?

For example: I want to run trough all log lines, ordered by id_user and date. For each 30 minutes a user navigate on my site, I count one visitor session, except for IPs inside a black list.

Is Splunk made for it?

Tags (1)
Highlighted

Re: Programming business rules inside Splunk

Communicator

Splunk can do just about anything provided you know how to write the search query. Take a look at the 'transaction' command - I believe it is what you seek -

http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction

0 Karma
Highlighted

Re: Programming business rules inside Splunk

Explorer

Thank you! I will take a look.

0 Karma
Highlighted

Re: Programming business rules inside Splunk

Explorer

This works fine, but I must always use that query-like structure inside Splunk?

Can I do some kink of structured programming inside Splunk?

Can I use Java inside Splunk?

0 Karma
Highlighted

Re: Programming business rules inside Splunk

Motivator

Splunk is pretty flexible. Take a look at lookup tables and custom search commands.

Lookup tables allow you to add new fields based on existing ones. Typically you'll use a CSV file, but you can also us custom Python code. Take a look at the earlier question about Using CIDR in a lookup table for more ideas.

Custom search commands allow you to take things further, and process search results almost any way you want. Again, these would be written in Python. For more information, look here and here.

For your example case, a lookup is the way to go. If you are blacklisting individual IP addresses, create a CSV-based lookup with two fields src_ip and blacklisted, then search for, e.g., blacklisted=1. If you want to use network ranges instead, try the subnet lookup script referenced here or use eventtypes.

Highlighted

Re: Programming business rules inside Splunk

Path Finder

have a try with: summary indexing and search macros

0 Karma