Hi all, I have a case about monitoring Linux servers. Here what i am trying to do. I am not sure this is possible or not but i have to do these things with possibilities because System Staff wanted these from me. 1-Root SSH access enabled servers --> Need Help 2-When someone changed sudoers file --> Done. 3-Root password change --> Done. 4-Users who have "0" ID except root --> Need Help   I did some steps but i need help about 2 step. Any help would be appreciated! ... View more

Hi all, I searched my issue on community. There are lots of threads but i couldn't find my issue. As i know i can not see 2 event ID's fields (both of them) in same search because fields are different. I want to see 2 different event ID's fields in same search. My issue is bit complicated. For this reason i will explain with basic fields and i will change later. First search: index=wineventlog EventID=1 process_name=chrome.exe | stats count by Image process_name process_path CommandLine Second search: index=wineventlog EventID=3 DestinationHostname=google.com | stats count by Image SourceIP DestinationIP DestinationHostname   I want join these 2 searches in same search and i want to see 2 different event ID' s fields in same search. I found join command but i couldn't figure out how to use that. Any help would be appreciated! ... View more

Hi there, I want to send email who have 4625 over 20 login fail count. I have search there is no problem about search but i couldn't figure out to send emails to specific users who have 4625 login fail events. I know trigger action like send mail but i couldn't figure out how to send specific users. I don't want to send email to a group, i need send email to specific users who have 4625 events.   Any help would be appreciated! ... View more

Hi, I need some analytics result in Splunk but i couldn't achieve. Here what i need. 1) Which EventIDs is repeated in which hostnames? I need this count based. EventID, Hostname and Count 2) Which EventIDs is used in which alerts (correleation searches and saved searches)? EventID, Alert Name 3) Which EventIDs triggered which alerts? EventID, Alert Name and count ... View more

Hi there, Our system administration wanted something from Blue Team. They want to view root privilege users except root user. They want to see [0:0] UID users except root users. Is it possible to see who have [0:0] UID? root:x:0:0:root:/root:/bin/bash I'm confused in this job. Any help would be appreciated! Kind Regards. ... View more

Dear Community, I have 2 question. First one i have index=linux and some computers. I want to track file modifications sudoers and sshd_config file. For example if someone makes a change on sshd_config i want to see this change on Splunk as a alert. I searched on the internet about this and couldn't find. Actually the real thing i want is tracking changing PermitRootLogin (sshd_config) string changes from No to Yes but as i know this is hard to detect in Splunk. Any help would be appreciated! ... View more

Hi all, I created a lookup 6 months ago and now i have hundreds of lookup and i forgot what was it's name. I am looking for an IP address in which lookup it is but i couldn't find a way to do this. I want to find out which lookup an IP address is in. Any help would be appreciated! ... View more

Hi there, I am new on Splunk and i am thinking to participate to all courses in here . I wonder what is the best sequence for joining them. I saw Fundamentals 1, 2 and 3 but they are mixed in that page and also others are mixed. Could you please make me an order for join them? Thanks in advance. Kind Regards. ... View more

Hi all, Hope you are well. I have a task about getting users'Chrome extension list with Splunk Search with queries. I couldn't figure out how can i do this. I am new on Splunk and sometimes i can ask too much questions to the community. Sorry about this. Thanks in advance. Best Regards. ... View more