Splunk 3.3.4 review

For the switch we disconnected and reconnected some host systems to generate syslog traffic whilst for the DP102 we ran port scans on our external IP address to simulate attacks. Selecting the syslog data source at the Splunk home page displayed all relevant data in seconds and we could see events for both devices. We could now set up email alerts by creating searches using the device names. This can't run in real time but you can schedule searches for as often as every minute. Custom index searches are used to create reports which can then be presented in graphical or tabular formats although these cannot currently be exported to PDF.

Splunk is clearly capable of handling logging data from a huge range of devices making it an ideal search tool for administrative and support staff along with those responsible for regulatory compliance. For the latter it's certainly better value than solutions such as those from LogRhythm and LogLogic and Splunk offers a choice selection of add-on applications with the PCI-DSS compliancy report package providing over 160 predefined searches.

Author: Dave Mitchell