Splunk Search

How to search and display all files or folders on a Windows drive that might have been hidden by a user?

New Member

Hi all,

I'm relatively new to Splunk and its syntax, so pardon if there is an obvious answer... I'm trying to find a way to query and show ALL files/folders on a drive that might have been hidden by the user (not looking for OS related system files/folders).

Possible? Easiest way to do that?

Thanks in advance!

0 Karma

SplunkTrust
SplunkTrust

The first question I'd have to ask back is, how are you expecting to have splunk see ANY files?

One way would be to have a script copy the directory to a file, then process the file.

For windows/dos shell commands,here's a page with a list of the switches that show hidden files and directories -
http://www.computerhope.com/issues/ch001039.htm

for unix/linux, it is LS with the -a flag.

See more at wikipedia here - https://en.wikipedia.org/wiki/Hidden_file_and_hidden_directory

0 Karma

Legend

Splunk can only search data in its own indexes. So first, you need to collect that information and send it to Splunk. If that information has been collected, then you need to know which index has that information.
After that, the search may be very easy - but you have to have the information to search first!

0 Karma

Splunk Employee
Splunk Employee

As @lguinn stated, you need data in Splunk (indexes) first before you can search on/across it.

For Windows filesystem related data, maybe this will help? https://docs.splunk.com/Documentation/Splunk/6.5.1/Data/MonitorfilesystemchangesonWindows

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!