Splunk searches relating to Linux

clear
Next Page
12
Splunk Search for Postfix messages sent over time Copy
sourcetype=postfix_syslog status=sent | timechart span=1d count
0 comments
Splunk Search for Failed linux logins by user Copy
sourcetype=linux_secure tag=authentication action=failure | stats count by user | sort - count
0 comments
Splunk Search for Successful linux logins over time Copy
sourcetype=linux_secure tag=authentication action=success | timechart count by src
0 comments
Splunk Search for Successful linux logins by source IP Copy
sourcetype=linux_secure tag=authentication action=success | stats values(user) as user, count by src
0 comments
Splunk Search for Failed linux logins by source IP Copy
sourcetype=linux_secure tag=authentication action=failure | stats values(user) as user, count by src
0 comments
Splunk Search for List of linux users who escalated privileges Copy
sourcetype=linux_secure "su: " OR "sudo: " | eval Date=strftime(_time, "%Y/%m/%d") | rex "\w{3}\s\d{2}\s\d{2}:\d{2}:\d{2}\s(?<hostname>\S+)" | regex _raw="\suser\sroot\sby" | rex "\suser\sroot\sby\s(?<user>\w+)" | stats count by user, host
0 comments
Splunk Search for Hosts where root user activity was identified Copy
sourcetype=linux_secure | rex "\w{3}\s\d{2}\s\d{2}:\d{2}:\d{2}\s(?<hostname>\S+)" | rex "\suser\s(?<User>[^\s]+)\s" | search User="root" | stats count as "Root Activity Count" by hostname
0 comments
Splunk Search for Most active linux hosts Copy
sourcetype=linux_secure | rex "\w{3}\s\d{2}\s\d{2}:\d{2}:\d{2}\s(?<hostname>\S+)" | top limit=10 hostname
0 comments
Splunk Search for Unique Linux Hosts Reporting Linux Secure Copy
sourcetype=linux_secure | rex "\w{3}\s\d{2}\s\d{2}:\d{2}:\d{2}\s(?<hostname>\S+)" | stats dc(hostname) as "Unique Hosts"
0 comments
Splunk Search for Events per linux host Copy
sourcetype=linux_secure | rex "\w{3}\s\d{2}\s\d{2}:\d{2}:\d{2}\s(?<hostname>\S+)" | stats count by hostname
0 comments
Next Page
12