cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
jwardsmith
New Member
Member since: ‎05-15-2023
‎05-15-2023
Community Statistics
Posts 1
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎05-15-2023
Topics I've Started
No posts to display.
View All

Re: Is file_hash field mapping missing for Splunk ...

by in All Apps and Add-ons
‎05-15-2023 04:15 PM
‎05-15-2023 04:15 PM
I had the same issue - searching across the Endpoint.Filesystem dataset would return the file_hash field with the value unknown.   I noticed that the calculated field (source::XmlWinEventLog:Microsoft-Windows-Sysmon/Operational : EVAL-file_hash) = case( EventCode IN ("15"), Hash, EventCode IN ("23","26"), Hashes ), and the event type for ms-sysmon-filemod = (source="WinEventLog:Microsoft-Windows-Sysmon/Operational" OR source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational") (EventCode IN ("2","11","23","26") ).   I modified the ms-sysmon-filemod to = (source="WinEventLog:Microsoft-Windows-Sysmon/Operational" OR source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational") (EventCode IN ("2","11", "15","23","26") ) For some reason Event Code 15 was showing in the event type ms-sysmon-process = (source="WinEventLog:Microsoft-Windows-Sysmon/Operational" OR source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational") (EventCode IN ("1","5","6","7","8","9","10", "15","17","18","24","25") )     ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎05-15-2023 09:20 PM