We use CardRecon to search our servers for credit card numbers.
CardRecon came back with a large number of credit card numbers found in .tsidx and .lex files in the splunk/lib/splunk/_internaldb/db/... directories.
These are just indexing files- and don't contain log data from log sources correct?
Can I consider them false positives?
Did you have a chance to check out an answer? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help you.
yes, those files are Splunk internal logs and by default do not contain any other events or log sources. I agree with you that you can consider them false positives.
