Reporting

report on syslog activity

Path Finder

Hello

I need a simple way to create some sort of report on what hosts log syslog data to splunk for syslog compliance to external party and if that could be a job that emailed it every month that would be great, if someone has a solution or tip that would be appreciated.

Tags (1)
0 Karma
1 Solution

Ultra Champion

This search may take a long time to finish, since it will actually go through each event for the sourcetype last month, BUT it will give you what you want.

sourcetype=syslog earliest=-1mon@mon latest=@mon | chart c by host date_month 

Hope this helps,

Kristian

View solution in original post

Ultra Champion

This search may take a long time to finish, since it will actually go through each event for the sourcetype last month, BUT it will give you what you want.

sourcetype=syslog earliest=-1mon@mon latest=@mon | chart c by host date_month 

Hope this helps,

Kristian

View solution in original post

Ultra Champion

Just be aware that this is not very efficient. /k

0 Karma

Path Finder

Yes, this did the trick, thank you.

0 Karma

Influencer

tuxford,

I think the quickest way would be to use the "metadata" command (docs here). As this provides results very (VERY) quickly. You could do something like (include the first pipe at the very beginning):

|metadata type=hosts index=_internal

And then once you have verified the results, simply create an alert (docs here) from the search view (flashtimeline). And have it email a report once a month (providing you have setup SMTP, docs here ).

Regards,

MHibbin

Path Finder

What I need is month, host and count of events by host for the last month. So the job runs on the first every month and reports that for the month before. If someone has a quick fix that would be great 🙂

0 Karma