Security

Event Hashing : Display Hash Values

gpburgett
Splunk Employee
Splunk Employee

When applying event hashing, Splunk currently adds a hidden field to the event showing whether or not the current hash values match with the hash values from index time.

Is there a way to display the original and current hash values for a given event to prove that Splunk's judgement is accurate?

(Picky government customer)

Tags (2)

mdessus_splunk
Splunk Employee
Splunk Employee

A new hashing solution will be available in next version.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

As of Splunk 6.2 this really isn't relevant anymore:

http://docs.splunk.com/Documentation/Splunk/6.2.2/releasenotes/Deprecatedfeatures

Features removed

IT data block signing
Audit signing
Event hashing
PDF Report Server App

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.