About BB2

BB2 · ‎05-29-2025

I understand this better now. Using the search you provided will search for anyone who did delete a record. I can then go into Splunk and search the timeframe for who actually performed the delete. index=_audit action=delete_by_keyword info=granted I can setup an alert using this search for any failure attempts to delete a record. index=_audit action=search info=failed | regex search="\\|(\\s|\\n|\\r|([\\s\\S]*))*delete"

BB2 · ‎05-29-2025

Could you tell me how to set that up? Or, can you point me to a location on how to do it?

BB2 · ‎05-29-2025

I am curious then why I do not get any results if I search for info=denied. I had attempted to delete a record several times and got the insufficient privileges but nothing showed up in the audit.log. index=_audit action=delete_by_keyword info=denied

BB2 · ‎05-29-2025

That will only tell me when the role delete_by_keyword has been assigned. It will not tell me if someone deletes data from them main index. I saw the role get assigned with that search as I added the can_delete role to the admin role.

BB2 · ‎05-29-2025

No, that didn't help. I tested deleting data on our test server but your search did return any results. I get the error below when trying to delete. I updated your search with what is in bold but it also did not return any results. Error in 'delete' command: You have insufficient privileges to delete events. I found a way to search for failed deletes by adding the info=failed. That would take care of failed attempts to delete data but would not be helpful if an admin performed a delete in a search. index=_audit action=search info=failed | regex search="\\|(\\s|\\n|\\r|([\\s\\S]*))*delete"

BB2 · ‎05-29-2025

Hello, Our company has gone through an audit and one of the auditors has asked us to monitor attempts to delete records in Splunk. I did some research and found the search item below which would do the trick. The issue is if I setup an alert with this, the alert is triggered because the previous search for this alert is saved and we get alerted for that search because the word delete is in that search. index=_audit action=search | regex search="\\|(\\s|\\n|\\r|([\\s\\S]*))*delete" Is there a way to ignore this search string when doing a search? Or has anybody been able to setup an alert for attempts to delete records? We only have 4 admins with the can_delete role but the auditors want to be sure if an admin tries to delete records, there will be an alert.

BB2 · ‎10-21-2024

Thanks for all the info. We are going to go with increasing the truncate on the index server.

BB2 · ‎10-18-2024

I have a question about breaking up a single line of data to send to the Splunk Indexer. We sending data which can have over 50,000 characters on a single line. I would like to know if there is a way to break up the data on the source server with the universal forwarder before sending it to the indexer and then reassemble it after it arrives at the indexer. We would like to know if this is possible rather than having to increase the Truncate size on the indexer to take all the data at once.

BB2 · ‎09-05-2024

Thanks everyone I will go through the upgrade route then. It will be safer that way.

BB2 · ‎09-04-2024

I have a question. We have an stand alone Splunk instance in AWS running version 7.2.3 and are looking to upgrade it to 9.3.0. I see to get to that version I will have to do about 4 upgrades. Also since our current version is running on RedHat version 6.4, I would have to upgrade that to get be able to run the current version What I am curious about is, AWS has a Splunk 9.3.0 AMI with BYOL. Would it be possible to migrate the data over to the new instance along with the configuration settings? This is used as a customer lab so we only have about a dozen universal forwarders pointing to this server. There are no alerts running on it and only 3 dashboards. The splunk home is stored on a separate volume than the OS so I could detach it from the old instance and attach it to the new one, or snapshot it and use the snapshot on the new one. Any suggestions for this? Thanks.

Posts	10
Solutions	2
Karma Given	1
Karma Received	0
Member Since	‎09-04-2024

Online Status	Offline
Date Last Visited	‎05-29-2025 07:08 AM

Monitor for delete attempts

Break single line of data.

Upgrade 7.2.3 to 9.3.0

Re: Monitor for delete attempts

Re: Monitor for delete attempts

Re: Monitor for delete attempts

Re: Monitor for delete attempts

Re: Monitor for delete attempts

Monitor for delete attempts

Re: Break single line of data.

Break single line of data.

Re: Upgrade 7.2.3 to 9.3.0

Upgrade 7.2.3 to 9.3.0

Are you a member of the Splunk Community?