https://community.splunk.com/t5/Splunk-Search/Splunk-hash-search/m-p/549543#M155934 <P>We have a list of hash values for a possible ransomeware attack and need to see if those hashes were ever in our environment.</P> Tue, 27 Apr 2021 23:15:47 GMT drdreday 2021-04-27T23:15:47Z https://community.splunk.com/t5/Splunk-Search/Splunk-hash-search/m-p/549531#M155926 <P>how do you search for hash value in splunk? Do we need to use a specific index?</P> Tue, 27 Apr 2021 21:11:15 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-hash-search/m-p/549531#M155926 drdreday 2021-04-27T21:11:15Z https://community.splunk.com/t5/Splunk-Search/Splunk-hash-search/m-p/549540#M155931 <P>More words are needed to understand your use case.&nbsp; Hash value of what?&nbsp; What problem are you trying to solve?</P> Tue, 27 Apr 2021 22:54:18 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-hash-search/m-p/549540#M155931 richgalloway 2021-04-27T22:54:18Z https://community.splunk.com/t5/Splunk-Search/Splunk-hash-search/m-p/549543#M155934 <P>We have a list of hash values for a possible ransomeware attack and need to see if those hashes were ever in our environment.</P> Tue, 27 Apr 2021 23:15:47 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-hash-search/m-p/549543#M155934 drdreday 2021-04-27T23:15:47Z https://community.splunk.com/t5/Splunk-Search/Splunk-hash-search/m-p/549545#M155936 <P>If you have the hashes in Splunk - perhaps reported by a firewall or email server - then, yes, you can search for them.&nbsp; They will be in the index in which they were saved.</P><P>If the hashes are not indexed in Splunk then you'll have a hard time searching for them.</P> Tue, 27 Apr 2021 23:42:36 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-hash-search/m-p/549545#M155936 richgalloway 2021-04-27T23:42:36Z