topic Re: How to write a search to find who deleted or modified files on a Windows server for the last 24 hours? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-who-deleted-or-modified-files-on-a/m-p/218728#M64292 <P>Hi,</P> <P>Before you can write a search to find out who deleted or modified files on Windows server, you need to enable some sort of file auditing.<BR /> Three options currently in Splunk:</P> <OL> <LI>Enable Windows native file auditing via security event logs and then tell Splunk to monitor those logs. See <A href="http://docs.splunk.com/Documentation/Splunk/6.3.2/Data/MonitorfilesystemchangesonWindows">this link</A>.</LI> <LI>Use a third party tool to monitor file changes and point Splunk to the relevant logs.</LI> <LI>Use Splunk Enterprise File Change Monitor (deprecated so not recommended for a long term solution). See <A href="http://docs.splunk.com/Documentation/Splunk/6.3.2/Data/MonitorChangestoYourFileSystem">this link</A>.</LI> </OL> <P>In terms of performance, because we wanted to monitor any type of file operation, which includes millions of log entries per hour in some servers, we decided to go for a 3rd party enterprise agent that was known to have a low impact in your server performance, but in your case I would probably go for the native Windows file auditing via event logs.</P> <P>Once you have your event logs coming into Splunk, simply filter by the relevant index, sourcetype, host and EventCodes based on the Event IDs used by Windows auditing. See <A href="http://docs.splunk.com/Documentation/Splunk/6.3.2/Data/MonitorfilesystemchangesonWindows">this link</A> again for more information.</P> <P>Hope that helps.</P> <P>Thanks,<BR /> J</P> Sat, 09 Jan 2016 06:54:24 GMT javiergn 2016-01-09T06:54:24Z How to write a search to find who deleted or modified files on a Windows server for the last 24 hours? https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-who-deleted-or-modified-files-on-a/m-p/218726#M64290 <P>I am now very new to Splunk. I have installed a Splunk forwarder to monitor Window Security Logs, but would like also build a search to search who deleted and modified files / folder for the last 24 hours. Please point me to the right direction. Also, is it possible to prompt asking to enter the server name or file name when the search is running? Thanks.</P> Sat, 09 Jan 2016 02:13:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-who-deleted-or-modified-files-on-a/m-p/218726#M64290 mattkun 2016-01-09T02:13:55Z Re: How to write a search to find who deleted or modified files on a Windows server for the last 24 hours? https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-who-deleted-or-modified-files-on-a/m-p/218727#M64291 <P>start with</P> <PRE><CODE>index=&lt;your index&gt; EventCode=&lt;event code for your operation&gt; host=&lt;servername you want&gt; earliest=-24h </CODE></PRE> <P>References :</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/WhatsInThisManual">http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/WhatsInThisManual</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/GetstartedwithSearch">http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/GetstartedwithSearch</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/ListOfSearchCommands">http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/ListOfSearchCommands</A></P> Sat, 09 Jan 2016 04:28:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-who-deleted-or-modified-files-on-a/m-p/218727#M64291 renjith_nair 2016-01-09T04:28:08Z Re: How to write a search to find who deleted or modified files on a Windows server for the last 24 hours? https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-who-deleted-or-modified-files-on-a/m-p/218728#M64292 <P>Hi,</P> <P>Before you can write a search to find out who deleted or modified files on Windows server, you need to enable some sort of file auditing.<BR /> Three options currently in Splunk:</P> <OL> <LI>Enable Windows native file auditing via security event logs and then tell Splunk to monitor those logs. See <A href="http://docs.splunk.com/Documentation/Splunk/6.3.2/Data/MonitorfilesystemchangesonWindows">this link</A>.</LI> <LI>Use a third party tool to monitor file changes and point Splunk to the relevant logs.</LI> <LI>Use Splunk Enterprise File Change Monitor (deprecated so not recommended for a long term solution). See <A href="http://docs.splunk.com/Documentation/Splunk/6.3.2/Data/MonitorChangestoYourFileSystem">this link</A>.</LI> </OL> <P>In terms of performance, because we wanted to monitor any type of file operation, which includes millions of log entries per hour in some servers, we decided to go for a 3rd party enterprise agent that was known to have a low impact in your server performance, but in your case I would probably go for the native Windows file auditing via event logs.</P> <P>Once you have your event logs coming into Splunk, simply filter by the relevant index, sourcetype, host and EventCodes based on the Event IDs used by Windows auditing. See <A href="http://docs.splunk.com/Documentation/Splunk/6.3.2/Data/MonitorfilesystemchangesonWindows">this link</A> again for more information.</P> <P>Hope that helps.</P> <P>Thanks,<BR /> J</P> Sat, 09 Jan 2016 06:54:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-who-deleted-or-modified-files-on-a/m-p/218728#M64292 javiergn 2016-01-09T06:54:24Z