About 5plunked

5plunked · ‎02-19-2018

Hi all, I am trying to create a shell script periodically with crontab to run a Splunk search query, and if there are any results/events found in the search query, it will send an email alert with the crontab. I need some guidance on achieving that as right now, i am new to writing a bash script to run on Splunk. I am using Splunk Free with no alert functions. Any help will be appreciated! Thank you so much 🙂

jplumsdaine22 · ‎01-05-2018

You probably overwrote some of the 7.0 settings with 6.3.3 ones, breaking splunk. The correct procedure would be to move the entire $SPLUNK_HOME to the new server, and then upgrade to 7.0.1 (http://docs.splunk.com/Documentation/Splunk/7.0.1/Installation/HowtoupgradeSplunk)

marycordova · ‎01-16-2020

Here is a post I wrote about using Splunk Stream as a honeypot: https://answers.splunk.com/answers/794911/how-to-deploy-a-honeypot-using-splunk.html?childToView=794912#answer-794912

5plunked · ‎11-16-2017

thanks a lot! This is exactly what i was looking for 🙂

5plunked · ‎11-09-2017

hi i have read up on the Collect command documentation. From what i have understand, this command actually moves the data into a summary index and summarizes the existing events, which is not what i want. i have also tried running the command like this: index="main" host="host" source="(filepath)" sourcetype="tsv" action="(some_action)" | collect index="newindex" and it does not appear in the summary index nor the new index. Is there something wrong with my search query?

5plunked · ‎10-19-2017

Thank you, this is extremely helpful! 🙂

pdoconnell · ‎10-09-2017

Said this above, but look at https://github.com/pdoconnell/TA-microsoft-windefender for now. When this ends up on SplunkBase, I'll link there.

woodcock · ‎10-08-2017

Like this: tstats count WHERE source=* BY source

Posts	13
Solutions	1
Karma Given	3
Karma Received	1
Member Since	‎10-07-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Using REST API to search and send an email if ther...

Migrating Splunk to new server and upgrading it, b...

Can I use Splunk Enterprise to set up monitoring o...

how can i add my index to the search app to search...

oneshot and delete re-index duplicate data help

How can I create a table with the currently logged...

How can I view scan logs from Windows Defender?

How do I create a bar chart showing the different ...

Using REST API to search and send an email if ther...

Re: Migrating Splunk to new server and upgrading i...

Re: Can I use Splunk Enterprise to set up monitori...

Re: how can i add my index to the search app to se...

Re: oneshot and delete re-index duplicate data hel...

Re: How can I create a table with the currently lo...

Re: How can I view scan logs from Windows Defender...

Re: How do I create a bar chart showing the differ...