Security

Event Hashing : Display Hash Values

gpburgett
Splunk Employee
Splunk Employee

When applying event hashing, Splunk currently adds a hidden field to the event showing whether or not the current hash values match with the hash values from index time.

Is there a way to display the original and current hash values for a given event to prove that Splunk's judgement is accurate?

(Picky government customer)

Tags (2)

mdessus_splunk
Splunk Employee
Splunk Employee

A new hashing solution will be available in next version.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

As of Splunk 6.2 this really isn't relevant anymore:

http://docs.splunk.com/Documentation/Splunk/6.2.2/releasenotes/Deprecatedfeatures

Features removed

IT data block signing
Audit signing
Event hashing
PDF Report Server App

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...