BACK TO PROJECTS
RELIABILITY / OPERATIONS
Log Anomaly Detector.
A log analysis tool that turns simulated failures into reports someone can investigate.
5,000synthetic events analyzed
1,009 overlapping rule detections
1,009 overlapping rule detections
A REAL EXAMPLE
What happens
Run the seeded log generator, then parse the records and apply the detection rules. The report shows which rule fired and where to look next. One event may appear in more than one detection.
Why I made it
When a service fails, the first questions are usually when it started, what changed and which requests were affected. I used generated logs to practice finding and recording those answers.
How it works
Synthetic logs→Parser→Rules / baseline→Reports→Local Splunk
- A seeded log generator, parser and separate output for malformed records.
- Rules for HTTP 5xx, slow requests, severity and database timeouts, plus rolling windows for error spikes.
- CSV, JSON and HTML reports plus a local Splunk dashboard, saved alert and runbook.
Choices I made
- I fixed the generator seed so someone else can reproduce the same investigation.
- The reports keep the rule and threshold behind each finding, and they work without a Splunk installation.
What I checked
- 5,000 records parsed with no malformed records in the documented dataset.
- 1,009 rule detections; a single event may match multiple rules, so these are not unique incidents.
- 18 passing tests and 0.123698-second median scripted runtime over seven local runs.
Where it stands
- These are synthetic logs, not a production incident or measured customer impact.
- Splunk runs locally. The linked operations report is a separate, published HTML output.