Basic Query help

[mnmn777]

I just want to look for a hash signature in Splunk. 

Example: d09a773dab9a20e6b39176e9cf76ac6863fe388d69367407c317c71652c84b9e

What is the basic query please? 

[gcusello]

Hi @mnmn777,

sorry but I don't understand your need:

the hash you shared is what you want to search in your logs or what else?

if this is waht you want to search, you can use this string in a simple search:

index=your:index d09a773dab9a20e6b39176e9cf76ac6863fe388d69367407c317c71652c84b9e

if you could add more informations to you question we'd be able to help you.

CIao.

Giuseppe

[mnmn777]

I want to see if a file, which has that SHA256 signature is in my Enterprise or logs. 

[gcusello]

Hi @mnmn777,

If you have in your logs the SHA of many files, you can use Splunk to search that signature, which data have you to search?

Ciao.

Giuseppe