Reporting

What is a simple server activity query?

bbainunc
Explorer

Looking to brush off the cobwebs of my Splunk use and wanted to find a simple query of server activity/traffic for a server on our domain.  If anyone has a basic query they use on a regular basis to see traffic on their servers, I'd appreciate if you could share it, once I get the basic syntax, I can take it from there.

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @bbainunc,

I hint to follow some training, starting from:

Splunk Search Tutorial https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchTutorial/WelcometotheSearchTutorial

getting data in https://docs.splunk.com/Documentation/Splunk/8.2.6/Data/Getstartedwithgettingdatain

in this way you can understand how to take data in Splunk and how to use them.

On the Splunk Channel of YouTube you can also find many useful video that explayin how Splunk works, but anuway starts from the above two points.

About your question is too poor to answer, you should describe:

  • which data you are speaking about,
  • if you already have them in Splunk or not.

Ciao.

Giuseppe

0 Karma

bbainunc
Explorer

Of course I have reviewed tutorials before posting to this forum, I specifically said server traffic, so that answered the data question.  I know this is an easy query, was just looking for a boost to spark my memory Your post was not only unhelpful, but kind of condescending. 

0 Karma

state_larson_ti
Path Finder

@bbainunc wrote:

Of course I have reviewed tutorials before posting to this forum, I specifically said server traffic, so that answered the data question.  I know this is an easy query, was just looking for a boost to spark my memory Your post was not only unhelpful, but kind of condescending. 


https://lantern.splunk.com/Security/Use_Cases/Security_Posture/Monitoring_for_network_traffic_volume...

This link provides some good examples of looking for network traffic assuming you have a data set ingested.  I hope this is helpful.

 

Kindest,

 

T

 

Tags (1)
0 Karma

bbainunc
Explorer

Thank you, that is what I was looking for just to get started.

state_larson_ti
Path Finder

Giuseppe was providing useful information.  It is not clear to me what server environment you are using, and if you have tried the use local logs or if you want, in the case of network traffic, to pull in a .pcap file.  Also, the answer for server activity changes if you have a linux or a windows server.  Giuseppe is pretty good if you can be a bit more specific.

 

Cheers and good luck!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...