report on syslog activity

[tuxford]

Hello

I need a simple way to create some sort of report on what hosts log syslog data to splunk for syslog compliance to external party and if that could be a job that emailed it every month that would be great, if someone has a solution or tip that would be appreciated.

[kristian_kolb · Accepted solution]

This search may take a long time to finish, since it will actually go through each event for the sourcetype last month, BUT it will give you what you want.

sourcetype=syslog earliest=-1mon@mon latest=@mon | chart c by host date_month 

Hope this helps,

Kristian

[kristian_kolb]

Just be aware that this is not very efficient. /k

[tuxford]

Yes, this did the trick, thank you.

[MHibbin]

tuxford,

I think the quickest way would be to use the "metadata" command (docs here). As this provides results very (VERY) quickly. You could do something like (include the first pipe at the very beginning):

|metadata type=hosts index=_internal

And then once you have verified the results, simply create an alert (docs here) from the search view (flashtimeline). And have it email a report once a month (providing you have setup SMTP, docs here ).

Regards,

MHibbin

[tuxford]

What I need is month, host and count of events by host for the last month. So the job runs on the first every month and reports that for the month before. If someone has a quick fix that would be great 🙂