Splunk Operational Intelligence Cookbook - Third Edition

How to do it...

Follow the steps in this recipe to identify potential session spoofing activity:

1. Log in to your Splunk server.
2. Select the Splunk Machine Learning Toolkit application.
3. Click on the Assistants dropdown menu and select Forecast Time Series:

4. Ensure the time range picker is set to Last 90 Days and type the following search into the search bar. Then, click on the search button or hit Enter:

index=main sourcetype=log4j requestType="checkout" | timechart sum(total) AS total span=1week 

5. The Splunk Machine Learning Toolkit will now return a Raw Data Preview of the results:

6. Now, let's choose the appropriate options to perform ...