Questions tagged [splunk]

For questions about Splunk, a software product used for searching, monitoring, and analyzing machine-generated data.

Filter by
Sorted by
Tagged with
0
votes
0answers
32 views

How can I merge multiple individual worksheets in an Excel workbook that are in the same format (but different lengths)?

I have an inherited (and sometimes still-updated) workbook with many worksheets (currently 50+). Each of these tabs has a table in the format of: segment_name | subsegment | subnet | ipaddress ^^...
1
vote
1answer
78 views

WinEventLog for monitoring BitLocker

I am a Newbie to Splunk and working on monitoring the BitLocker process. I was wondering if any Windows Security log that I can leverage to check whether the BitLocker was launched by someone to ...
0
votes
0answers
64 views

How to prevent malicious use of BitLocker

I was wondering if anyone has thought about a scenario in which BitLocker can be used as ransomware. For example, if the hacker was granted access to the system, and used BitLocker to encrypt the disk....
2
votes
2answers
55 views

How to query events that happened in a specific order?

Say I have the following events in Splunk (ordered chronologically): operator=zeroPointModule id=123 action=start operator=foobar id=123 action=start operator=zeroPointModule id=123 action=stop ...
0
votes
1answer
555 views

Can't access Splunk Enterprise from Web GUI

I installed Splunk Enterprise 8 splunk-8.0.0-1357bef0a7f6-linux-2.6-x86_64.rpm but due to low space, I attach new HDD 50GB and created a partition and mounted it on /opt. Then I moved all the data ...
0
votes
2answers
539 views

Dedup is not working on Splunk

Please see picture below. I inserted dedup for job_duration, but it was not showing in the search result. I only need one result to do visualisation.
0
votes
0answers
59 views

Splunk is not triggering action

Our system has Splunk installed and indexing a directory for log files. A search string of "uploaded file" is set at All time (real-time). The search is saved as an alert. When creating the alert real-...
0
votes
1answer
45 views

How can I monitor a process being or arguments of a specific utility in my network?

Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. It can also be used to bypass process whitelisting through use of attributes within the binary that ...
0
votes
0answers
55 views

Is it possible to add blank lines in between results when using Spunk CLI search?

I'm using RHEL 6.10 and using the Splunk CLI to find "transactions" (groups of results together). It is searching for rtvscand log lines. /opt/splunk/bin/splunk search \ 'syslog_source=rtvscand | ...