index=security action=failure | stats count dc(user) as users values(user) as user_list by src | where count >= 20 AND users >= 5

index=main earliest=-15m | table _time host source sourcetype _raw

df -h lsblk free -h ulimit -n hostname -f timedatectl

sudo tar -xzf splunk-<version>-Linux-x86_64.tgz -C /opt sudo chown -R splunk:splunk /opt/splunk sudo -u splunk /opt/splunk/bin/splunk start --accept-license sudo /opt/splunk/bin/splunk enable boot-start -user splunk

msiexec.exe /i splunk-<version>-x64-release.msi AGREETOLICENSE=Yes /quiet

$SPLUNK_HOME/bin/splunk btool inputs list --debug $SPLUNK_HOME/bin/splunk btool outputs list --debug

du -sh $SPLUNK_HOME/var/lib/splunk/* find $SPLUNK_HOME/etc -name "*.conf" tail -f $SPLUNK_HOME/var/log/splunk/splunkd.log

$SPLUNK_HOME/etc/apps/my_inputs/local/inputs.conf [monitor:///var/log/myapp/app.log] index = app sourcetype = myapp:log

hostname -f timedatectl status id splunk ss -lntp | grep -E "8000|8089|9997|8088"

[security] homePath = $SPLUNK_DB/security/db coldPath = $SPLUNK_DB/security/colddb thawedPath = $SPLUNK_DB/security/thaweddb frozenTimePeriodInSecs = 7776000

sudo tar -xzf splunkforwarder-<version>-Linux-x86_64.tgz -C /opt sudo chown -R splunkfwd:splunkfwd /opt/splunkforwarder sudo -u splunkfwd /opt/splunkforwarder/bin/splunk start --accept-license

/opt/splunkforwarder/bin/splunk add monitor /var/log/auth.log \ -index security -sourcetype linux_secure

/opt/splunkforwarder/bin/splunk add forward-server splunk01:9997

[WinEventLog://Security] disabled = 0 index = security renderXml = true [monitor://C:\Apps\MyApp\logs\*.log] disabled = 0 index = app sourcetype = myapp:log

$SPLUNK_HOME/bin/splunk enable listen 9997

[tcpout] defaultGroup = primary_indexers [tcpout:primary_indexers] server = idx01:9997, idx02:9997 autoLBFrequency = 30 [tcpout-server://idx01:9997]

$SPLUNK_HOME/bin/splunk set deploy-poll ds01:8089

index=* earliest=-24h | stats count min(_time) as first max(_time) as last by index sourcetype host | convert ctime(first) ctime(last)

[myapp:multiline] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)(?=\d{4}-\d{2}-\d{2}) TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 19

index=myindex earliest=-24h | eval delay=_indextime-_time | stats perc50(delay) perc95(delay) max(delay) by sourcetype

props.conf [myapp:log] TRANSFORMS-route = route_errors transforms.conf [route_errors] REGEX = level=ERROR DEST_KEY = _MetaData:Index FORMAT = app_errors

props.conf [myapp:log] REPORT-myfields = myapp_fields transforms.conf [myapp_fields] REGEX = user=(\S+) action=(\S+) FORMAT = user::$1 action::$2

curl -k https://splunk01:8088/services/collector/event \ -H "Authorization: Splunk <HEC_TOKEN>" \ -d '{"event":{"action":"login","status":"success"}, "sourcetype":"app:json","index":"app"}'

[monitor:///var/log/remote/firewall/*.log] index = network sourcetype = vendor:firewall host_segment = 4

index=security host=win01 earliest=-1h | stats count by source sourcetype EventCode | sort - count

index=linux earliest=-30m | stats count values(sourcetype) by host source | sort host source

index=security earliest=-15m | stats latest(_time) as last count by host sourcetype | eval age=now()-last | where age > 600 | convert ctime(last)

index=security action=failure | stats count by user | sort - count

index=web earliest=-60m latest=now status>=500 index=security (action=failure OR action=blocked) NOT user="healthcheck" index=app host=web* source="*/access.log"

index=security action=failure | table _time user src dest action reason | sort 0 - _time

index=security | sort 0 - _time | dedup user | fields _time user src action

index=security | stats count dc(user) as users by action

index=web status>=500 | timechart span=5m count by status limit=10

index=security | top limit=10 src

index=security | stats count as failures dc(user) as users by src | eval risk_score=failures + (users*5) | eval risk_band=case(risk_score>=100,"high", risk_score>=50,"medium", true(),"low") | where risk_score>=50

... | eval user=coalesce(user, user_name, account, src_user)

index=app sourcetype=myapp:log | rex field=_raw "user=(?<user>\S+) action=(?<action>\S+)" | stats count by user action

index=app sourcetype=app:json | spath | table _time user.name request.path response.status

... | regex process_name="(?i)(powershell|pwsh)\.exe$"

index=security | lookup assets.csv host OUTPUT owner criticality environment | table _time host owner criticality action

| inputlookup approved_scanners.csv | table src description owner

index=security action=success [ search index=security action=failure earliest=-30m | stats count by user | where count>10 | fields user ]

index=web status>=500 | stats count by host | append [ search index=web status>=400 status<500 | stats count by host ]

index=auth | eventstats avg(duration) as user_avg by user | eval ratio=duration/user_avg | where ratio>3

index=auth action=failure | sort 0 user _time | streamstats count as running_failures by user

index=app (action=start OR action=end) | transaction session_id startswith="action=start" endswith="action=end"

index=security tag=authentication | stats count by action user src dest

index=_internal sourcetype=splunkd log_level=ERROR earliest=-24h | timechart span=15m count by component limit=10

index=_internal sourcetype=splunkd (log_level=WARN OR log_level=ERROR) | table _time host component log_level message | sort 0 - _time

nc -vz splunk01 9997 $SPLUNK_HOME/bin/splunk list forward-server

index=risk | stats sum(risk_score) as total_risk values(search_name) as reasons by risk_object risk_object_type | where total_risk >= 100 | sort - total_risk

index=network | lookup threat_intel_ip indicator as dest_ip OUTPUT confidence description | where isnotnull(confidence) | table _time src_ip dest_ip confidence description

index=security action=failure earliest=-15m | stats count dc(user) as targeted_users values(user) as users by src | where count>=20 AND targeted_users>=10

index=security src=<SOURCE_IP> action=success earliest=-30m | table _time user src dest app

index=security sourcetype=XmlWinEventLog:* EventCode=4104 | eval script=coalesce(ScriptBlockText, Message) | where match(script,"(?i)(-enc|-encodedcommand|downloadstring|frombase64string)") | table _time host user script

index=web earliest=-30m status>=400 | timechart span=5m count by status limit=10

index=web status IN (401,403,404) earliest=-15m | stats count dc(uri_path) as paths values(uri_path) as examples by src_ip | where count>=100 AND paths>=20

index=network action=allowed earliest=-24h | stats sum(bytes_out) as bytes_out dc(dest_ip) as destinations by user src_host | eventstats avg(bytes_out) as avg stdev(bytes_out) as sd | where bytes_out > avg + (3*sd) | sort - bytes_out