Splunk Operational Intelligence Cookbook - Third Edition

How to do it...

Follow the steps in this recipe to identify potential session spoofing activity:

1. Log in to your Splunk server.
2. Select the Splunk Machine Learning Toolkit application.
3. Click on the Assistants dropdown menu and select Detect Numeric Outliers:

4. Ensure the time range picker is set to Last 24 Hours, and type the following search into the search bar. Then, click on the search button or hit Enter:

index=main sourcetype="access_combined" | table _time response 

5. The Splunk Machine Learning Toolkit will now return a Raw Data Preview of the results:
6. Now, let's choose the appropriate options to perform outlier detection. From the ...