Reporting

What is a simple server activity query?

bbainunc
Explorer

Looking to brush off the cobwebs of my Splunk use and wanted to find a simple query of server activity/traffic for a server on our domain.  If anyone has a basic query they use on a regular basis to see traffic on their servers, I'd appreciate if you could share it, once I get the basic syntax, I can take it from there.

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @bbainunc,

I hint to follow some training, starting from:

Splunk Search Tutorial https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchTutorial/WelcometotheSearchTutorial

getting data in https://docs.splunk.com/Documentation/Splunk/8.2.6/Data/Getstartedwithgettingdatain

in this way you can understand how to take data in Splunk and how to use them.

On the Splunk Channel of YouTube you can also find many useful video that explayin how Splunk works, but anuway starts from the above two points.

About your question is too poor to answer, you should describe:

  • which data you are speaking about,
  • if you already have them in Splunk or not.

Ciao.

Giuseppe

0 Karma

bbainunc
Explorer

Of course I have reviewed tutorials before posting to this forum, I specifically said server traffic, so that answered the data question.  I know this is an easy query, was just looking for a boost to spark my memory Your post was not only unhelpful, but kind of condescending. 

0 Karma

state_larson_ti
Path Finder

@bbainunc wrote:

Of course I have reviewed tutorials before posting to this forum, I specifically said server traffic, so that answered the data question.  I know this is an easy query, was just looking for a boost to spark my memory Your post was not only unhelpful, but kind of condescending. 


https://lantern.splunk.com/Security/Use_Cases/Security_Posture/Monitoring_for_network_traffic_volume...

This link provides some good examples of looking for network traffic assuming you have a data set ingested.  I hope this is helpful.

 

Kindest,

 

T

 

Tags (1)
0 Karma

bbainunc
Explorer

Thank you, that is what I was looking for just to get started.

state_larson_ti
Path Finder

Giuseppe was providing useful information.  It is not clear to me what server environment you are using, and if you have tried the use local logs or if you want, in the case of network traffic, to pull in a .pcap file.  Also, the answer for server activity changes if you have a linux or a windows server.  Giuseppe is pretty good if you can be a bit more specific.

 

Cheers and good luck!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...