Скачать или смотреть Splunk Reports - Splunk Tutorial

Splunk Reports is a free tutorial by Zeal Vora from Splunk course
Link to this course(Special Discount):
https://www.udemy.com/course/splunk-b...
This is the best Splunk Course
Course summary:
Build Highly Available Clustering Architectures
Design and Create Dashboards to detect anomalies
Implementing Splunk in Docker Containers
Troubleshooting and Industry Best Practices in Managing Splunk
English [Auto]
Hate you. And welcome back. In today's video we will be discussing abought Plunker REPORTS. Now the best way to understand cancer is through sample use case. So let's take a sample use case. Now you have a security manager and there is a use case that a security manager should be formed with the list of ideal addresses and location from which Phil says his attempts are being made. I don't believe that to a default us or. So what do you use. Is that a security manager within your organization needs a list of IP addresses and its associated country from which of the assets that authentication or are we dealing with. Now this is something of it is you would see in lot of organizations. So let's look into how you can achieve this specific possibility. So let me go to the secure log and select day. Now real quickly do action is equal to failure. So this is forced by now since the current three days are needed. I'll do a I bilocation source and this will basically give me the country specific details. And the last thing that I would need is a stable table of source IP address and that. So these are all the results that I present. Now one important point to remember is that these results can be exported from black. Now if you see you have the option for export now you can export this way for many Let's see. We examine J-Zone and does. So let's let just the CAC and the failing that I get is feed as they say. There's now a number of reasons. I'll just leave it as you like and I'll go ahead and export it and you will see it got exported. So if I click on the CSP fight you will see that I have to specify big fees which are available why this source and tech in this country so this is something which I would really like. Now I love it that one thing that you might want to remember is that there are a lot of IP addresses which are getting repeated. Basically you'll see this as a brute force factor. So generally if you do not want the same IP address to be repeated hundred or thousand times you can make use of unique pattern. So you need to make sure that whatever IP address is that you have where you are they are not bitter. So you'll only have a unique set of IP addresses which are presented to you. So once you have done that what you do is you have to automate this because the security manager wants this report at the 24 hour interval. So one thing is you know every great devote I used on this basically the query you export the result and you send it to a security manager. But if you're a lazy person like me you might want to automate it completely. So plan would do that for you. So the way that you can do that is that once you have this gradated them and you have a proper output as expected what you can do is you can save this so if you see there's an option policy as you can see this as a reboot. Now the report title I would say this is brute force attempts. And the timeline speaker Liebig as a default of yes I can see now it is saying that your report has three. And actually can you. Now this is the board that was created no since we had the nearby Diemen's because we can actually click on a specific time pad our report would be changed accordingly. Now this report which is created now what we want is that report on this specific report should be adequate before our entire world. So if you'll click on it here you have various options like that description. Bob mentioned shell do something that we are interested in so we can educate you. Now the report is a box that they select. Now you can't run it every hour. You can't run it every day every week every month or you don't even have your own custom cron to do it. So I run it every day. I enter it at 2:00 a.m. in the every day. Now that time change you can select the time range not required since you are running it at 20. Now the price is important so if there's a resource limitation you can have this report especially if this is important for you to be. Now there are good actions is the actions that could happen after the report is created. So whether you want this report details should be sent in email or some type of a script children or there is an external book which you can integrate. It's awful like like others so we can't select on send e-mail. You can put us or whatever he may like you have no privacy associated with it. No the subject