Hello,
Sometimes the filePath of an action has a semicolon and a series of numbers and letters attached to the end. For example, "/filepath/example.txt;5fb02008"
It shows up in relation to various servers, events, file types, and times. It does not appear on all filePaths. We have Linux servers. It only happens on creation actions.
The series of numbers and letters (i.e. ;5fb02008) will stay the same for each action that is executed by the same source, so there will be 10 - 100's of actions executed at once with this number tagged on. The series of letters and numbers never repeats for separate instances, so if it happened on 10 events at 8am and looked like "*.txt;5fb02008" it would look completely different, for example "*.txt;5fb9y654" if it came up on a series of actions at 3pm.
Sometimes duplicate actions will appear with and without the addition. For example one event happening at filePath "/example1.conf;5fb02008" and another at "/example1.conf" at the same time. However, sometimes an action shows up only with the addition to the file path "/example2.conf;5fb02008" and no corresponding action without the addition
Does anyone know the cause of this? Is it related to how Splunk reads data at all? Or is it unrelated to Splunk and happening somewhere on our host/user end? Is it something Apache did? Is it indicating a particular user?
It's been happening for a long time and I'm not sure if it is Splunk related or not.
Appreciate if anyone can provide insight!
