topic How to locate a specific SHA1SUM value on the entire Redhat file system via Splunk search? in Splunk Search

How to locate a specific SHA1SUM value on the entire Redhat file system via Splunk search?

abidewan — Wed, 04 Jan 2017 22:54:31 GMT

How locate specific SHA1SUM value on the entire redhat file system via splunk search?

Re: How to locate a specific SHA1SUM value on the entire Redhat file system via Splunk search?

jplumsdaine22 — Thu, 05 Jan 2017 09:51:15 GMT

Are you logging the SHA1SUMs to a file? Or you want splunk to calculate the SHA1SUM for every file on your host?

Re: How to locate a specific SHA1SUM value on the entire Redhat file system via Splunk search?

abidewan — Thu, 05 Jan 2017 20:48:40 GMT

Splunk to check which files in the entire file system has specific SHA1 checksum value.
For example: Show all files that have sha1sum 7716D83C0D06AB356BDFA52DEF1AF64BC5210

Re: How to locate a specific SHA1SUM value on the entire Redhat file system via Splunk search?

jplumsdaine22 — Fri, 06 Jan 2017 14:18:18 GMT

You could possibly create a script that continuously crawls your entire filesystem and logs the following:

modtime filename sha1sum

Then you could index that log file and find the files you are after and the modtime they had that sha1sum.

But it's not possible to compare an arbitrary sha1sum to the current filesystem with Splunk. Although you could potentially create some kind of custom command.