Splunk Search

Basic Query help

mnmn777
Observer

I just want to look for a hash signature in Splunk. 

Example: d09a773dab9a20e6b39176e9cf76ac6863fe388d69367407c317c71652c84b9e

What is the basic query please? 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mnmn777,

sorry but I don't understand your need:

the hash you shared is what you want to search in your logs or what else?

if this is waht you want to search, you can use this string in a simple search:

index=your:index d09a773dab9a20e6b39176e9cf76ac6863fe388d69367407c317c71652c84b9e

if you could add more informations to you question we'd be able to help you.

CIao.

Giuseppe

0 Karma

mnmn777
Observer

I want to see if a file, which has that SHA256 signature is in my Enterprise or logs. 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mnmn777,

If you have in your logs the SHA of many files, you can use Splunk to search that signature, which data have you to search?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...