The CLI did the trick. Thanks! ... View more

Do you want the hash of the file or the hash of the filename? The filename you can hash easily enough like | eval hash=md5(filename_field) . There shouldn't be a need to index that - you can run it at search time. If you want to calculate the hash of the file itself you'll need to do that with a scripted input - the universal forwarder by itself won't pull that from the event log (unless there is a windows event that contains that information) There are most likely many answers on here about the best way to do malware monitoring - also check out the channel #security on the Splunk slack for more advice ... View more