Splunk Search

Frequency analysis on names in splunk

hmi79
Loves-to-Learn

Is there a built-in solution in splunk that does the frequency analysis (for ex. on domain names) ?

There is a solution by Mark Baggett in https://github.com/MarkBaggett/freq but I had problems using it in splunk.

It either can be run using the python script:

$ python3 freq.py freqtable2018.freq -m splunk.com
(6.0006, 5.0954)

Or using curl:

$ curl http://127.0.0.1:20304/measure/splunk.com

(6.0006, 5.0954)

I want to run it against a field for ex. called "query" in my zeek dns logs and calculate the frequency and save it in another field 

Labels (5)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

As always in a community forum, you get better answers by better define your use case.  Can you define "frequency analysis" in your context?  Most importantly, from what kind of source are you counting?  What result do you expect from such sources?  What is the logic between the source and the result?

You mentioned DNS logs.  Suppose your logs have a field named domain.  Do you mean to count how many queries each domain gets in unit time, say, an hour in a given search period, say, past 24 hours?

source=mydnslogs
| timechart span=1h count by domain

What other "analysis" you want to apply?  Sort by frequency?

| sort - count

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...