How to do log analysis using splunk

[srinivas0704]

I am working on approach to upload logs to splunk,I have set of queries to query in logs and extract the values.How to run queries as soon as one user uploads logs without himself querying and give him the results

[gcusello]

Hi @srinivas0704,
you could create an alert, running e.g. every five minutes that checks logs upload and send an email with the results.
the problem is: how many users do you have for this job? if they are a limited number you could create an alert for each one with his email, if they are many is more difficoult.

ciao.
Giuseppe

[srinivas0704]

@gcusello Thanks for looking into, there are many. Is there some way when user uploads the logs it does all the queries automatically and show result

[gcusello]

Hi @srinivas0704,
you could create a dashboard that displays all the data in an index, but the user should insert some parameters to find the uploaded logs (e.g. source or index or sourcetype).

One question: when you speak of log upload, are you speaking of the UI guided procedure?
if yes at the end of the procedure Splunk shows a button to display all the loaded events.

ciao.
Giuseppe

[srinivas0704]

@gcusello Log upload is about application logs which user uploads himself and he should get to know whats the issue on uploading logs

[gcusello]

Hi @srinivas0704,
as i said, at the end of the UI guided procedure user has a button to display all the loaded events.

ciao.
Giuseppe

[gcusello]

Hi @srinivas0704,
see these:
https://www.youtube.com/watch?v=3GKhCZfQqDM
https://dev.splunk.com/enterprise/tutorials/quickstart/adddata

Ciao.
Giuseppe

[srinivas0704]

@gcusello Thanks will refer this

[srinivas0704]

@gcusello Checked the video but they are still querying. Sry if I am not clear. I have a list of queries which should be executed on each and every logs user uploads and give results to them of queries executed

[gcusello]

The only way is to create more alert with all your queries and send results to you users, otherwise, they can access results in alerts.
Ciao.
Giuseppe

[srinivas0704]

ok will check this,thanks @gcusello

[srinivas0704]

@gcusello Do you have any guide on how to load the events so that it displays all the loaded events or queries