Search Commands Apps

Splunkbase is home to the apps and add-ons that run on top of Splunk. Browse the latest apps below, or share your own with the rest of the Splunk community. To learn more about Splunk and download a free Enterprise Trial of our software, visit Splunk.com.

AfterGlow for Splunk 3.x

This search processor enables the generation of link graphs through Splunk. Make sure you follow the instructions in the README (once installed, located in etc/apps/afterglow) to configure the application!

Type: Security Applications | Splunk Version: 3.x | Author: raffy
More »
Screenshot

PCI App - Creative Commons Version

The PCI application is a collection of modular sub-applications designed to meet the needs of a CISO dealing with a PCI auditor.

Type: App | Splunk Version: 4.x | Author: binaryarp
pci
More »

Splunk for use with amMap Flash Maps

This app uses the amMap geo mapping capabilities to create flash maps of activity by IP in your Splunk index.

Type: Add-On | Splunk Version: 4.x | Author: will More »
Screenshot

Geo Location Lookup Script

Splunk for Use with MAXMIND is an application that provides geo_ip information on any public IP in your Splunk DB in a scalable fashion. The GeoIPCityLite DB is apart of the app so no internet connection is required and lookups are performed locally on your search head. The use is simple, pipe any search to ' lookup geoip clientip as <some_ip_field> ' If you do not have an IP field in your data you can use the rex command to extract one and perform a lookup Example Searches: eventtype=firewall_event | lookup geoip clientip as src_ip sourcetype=syslog | rex field=_raw "(?<ip>\d+\.\d+\.\d+\.\d+)" | lookup geoip clientip as ip This product includes GeoLite data created by: MaxMind available from: http://www.maxmind.com/

Type: Add-On | Splunk Version: 4.x | Author: will More »

Reverse Name Resolution Search Script (DNS)

This search script (nslookup.py) will perform reverse name lookup on every IP from an event at search time.

Type: Domain Name Service [DNS] | Splunk Version: 3.x | Author: rataide
More »

Splunk reverse DNS lookup for fields

Replaces IP addresses in specified fields with the results of a DNS lookup of the field contents. Pipe results to the "nsresolve" command, specifying the fields to replace, e.g. index=sampledata src=* | head 10 | nsresolve src ip

Type: None | Splunk Version: 3.x | Author: gkanapathy
More »

getdevicetype

This search command will parse a csv file exported by network or systems device management software and match the hostnames/ip addresses in the file to host field values in you Splunk search, returning the new field devicetype for every match. The csv location is specified at the top of the script, and if you wish you can also alter the field matching to something other than "host" by changing the field variable in the script. The csv must be in the format "device_name,device_type". Thus, you can type: login | getdevicetype | where devicetype="cisco6500" to get only logins on cisco6500 devices or login | getdevicetype to get devicetype to display as a field below each event and be filterable and clickable like host and hosttag. or login | getdevicetype | top devicetype to get a report of number of events by devicetype.

Type: Networking | Splunk Version: 3.x | Author: araitz
More »

Perfgraph

A Splunk performance visualization search processor. See <a href="http://dev.splunk.com/2007/10/11/diagraming-splunk%e2%80%99s-data-flow-part-2-performance-overlays/">my blog</a> for more information.

Type: Splunk | Splunk Version: 3.x | Author: rdas
More »

Perl PDF Report Creator "Search Command"

Create customizable PDF reports using this perl script, which includes the Intersplunk.pm module written by Andrew Hoying. Some knowledge of Perl required to install the Perl PDF modules available via CPAN.

Type: Splunk | Splunk Version: 3.x | Author: aspina
More »

Splunk for Citrix XenServer Management

This Splunk application manages Citrix XenServers. It includes inputs, indexing, searches, reports, dashboards and field actions.

Type: Citrix virtualization | Splunk Version: 3.x | Author: Splunk
More »

Syslog Priority Decoder

this searchscript converts syslog priority into the appropriate severity and facility.

Type: Network Security | Splunk Version: 3.x | Author: kbains
More »

Tranaction eventbreaker

When doing a CLI search for transactions, it can be hard to know the start and end points of the events. This script adds line breaks (with timestamps) between the events.

Type: Operations | Splunk Version: 3.x | Author: kbains
More »

Information Adder

This search script will add additional information from a CSV file to your events. Changelog: v1.2 - Now includes basic error checking and additional fixes for malformed CSV files

Type: Analytics | Splunk Version: 3.x | Author: rataide
More »

Splunk for Zope

Identify and analyze log files from the Zope web application server

Type: Web Application Servers | Splunk Version: 3.x | Author: stonor
More »

Multrex

Multirex allows the extraction of multivalued fields in events where a given key may occur one or more times with one or more values.

Type: Splunk | Splunk Version: 3.x | Author: araitz
More »

NetTool

NetTool is a search processor that will filter search results to only show events that match a given CIDR block or IP address range.

Type: Networking | Splunk Version: 3.x | Author: araitz
More »

Intersplunk for Perl

A perl version of the python Intersplunk module that ships with Splunk.

Type: Splunk | Splunk Version: 3.x | Author: araitz
More »

hexdec

Convert hex values to base10 decimal values OR base10 decimal values to hex values.

Type: Splunk | Splunk Version: 3.x | Author: araitz
More »

Sendemail (Custom)

This custom sendemail allows email attributes (e.g. to, from, body, subject) on a per-alert basis.

Type: Splunk | Splunk Version: 3.x | Author: araitz
More »

IP2Location - GeoIP Lookups

Provide IP-to-location look up support via a free GeoIP API. Please see README for non-trivial installation instructions. Latest changes (See CHANGELOG for full details): * Enhancement: Added a switch ["-nodns"|"nodns"] to disable name resolution. Usage: ....| geoip -nodns dest_ip * Enhancement: Now only real RFC/1918 IPs will have the city populated with "RFC/1918" other IPs with no resolution revert to "Unknown"

Type: Network Security | Splunk Version: 3.x | Author: rataide
More »

Nagios 3.0.6

integration fo a nagios3.0.6 xxxxxxxxxxxxxxxxxxx

Type: None | Splunk Version: 3.x | Author: ymiranda
More »

Splunk for MySQL

A collection of Splunk scripted inputs, eventtypes, and reports for MySQL monitoring and diagnostics.

Type: None | Splunk Version: 3.x | Author: BobFox
More »

Splunk for Double-Take

Splunk for Double-Take, a collaborative platform, brings higher system availability, lower cost of maintaining availability, and simplified monitoring of business critical Microsoft Exchange and SQL Server environments. By adding the power of Splunk IT Search into the Double-Take offering, users can tap into the capabilities of real-time search, alerting, reporting and analysis, to aggressively and proactively ensure successful failover conditions through a broader view of their environment.

Type: MS Exchange | Splunk Version: 3.x | Author: kordless
More »
Screenshot

Search

Search is the Splunk interface for searching and analyzing IT data. It allows you to index data into Splunk, add knowledge, build reports, and create alerts. Splunk 4.0 includes a brand new search and reporting interface, and pre-built useful dashboards for monitoring your Splunk installation. The Search App can be used across many areas of IT including infrastructure management, application management, security and compliance.

Type: App | Splunk Version: 4.x | Author: Splunk More »
Screenshot

Example lookup using a Database

This is example of using the Splunk lookup search command to correlate a field that is in within Splunk with external field(s) that are in a database. The example is in the bin directory and is called countrylookup.py. After gunzip and tar extracting (tar zxvf dblookup.spl) the distribution, read the README.txt for instructions on usage. The purpose of this example to show how Splunk can be used to correlate events with fields that reside in an external database.

Type: Add-On | Splunk Version: 4.x | Author: ndoshi More »

What are Apps and Add-ons?

Apps give you insight into your IT systems with dashboards, reports, data inputs and saved searches that work in your environment from the moment they install. Save time and money with free plug-and-play solutions built by Splunk, our partners and users.

Add-ons let you tackle specific data problems directly. Built by Splunk partners and power users from the Splunk community, add-ons are smaller, reusable components that can change the look and feel of Splunk, add data sources or share information between users.

How Do I Get Them?

You can browse and install apps from the menu at left or through the App Launcher within your Splunk installation. Visit the Administration Manual to learn more about installing apps or add-ons.

Most Splunk apps and add-ons are completely free and work with both the Free and Enterprise versions of Splunk 4.x. If you're looking for apps for older versions of Splunk, visit the Splunkbase Archive.

Build Your Own

The Splunk developer framework makes it easy to turn your Splunk work into custom apps and add-ons. Read the Developer Manual to find out how.

Come back to Splunkbase when you're ready to show your app to the world and visit the Share page to upload your app to the Splunk community.