topic Re: Basic Query help in Splunk Search

Basic Query help

mnmn777 — Mon, 15 Mar 2021 17:59:36 GMT

I just want to look for a hash signature in Splunk.

Example: d09a773dab9a20e6b39176e9cf76ac6863fe388d69367407c317c71652c84b9e

What is the basic query please?

gcusello — Mon, 15 Mar 2021 18:04:16 GMT

sorry but I don't understand your need:

the hash you shared is what you want to search in your logs or what else?

if this is waht you want to search, you can use this string in a simple search:

index=your:index d09a773dab9a20e6b39176e9cf76ac6863fe388d69367407c317c71652c84b9e

if you could add more informations to you question we'd be able to help you.

CIao.

Giuseppe

mnmn777 — Mon, 15 Mar 2021 18:07:47 GMT

I want to see if a file, which has that SHA256 signature is in my Enterprise or logs.

gcusello — Mon, 15 Mar 2021 20:36:49 GMT

If you have in your logs the SHA of many files, you can use Splunk to search that signature, which data have you to search?

Ciao.

Giuseppe