Splunk usage
Quick deployment with Splunk docker container
For the quick deployment of a Splunk instance, the Splunk docker image (by Splunk) can be used.
Splunk search Cheat Sheet
Search commands
Command | Description | Example |
---|---|---|
| Removes events containing an identical value(s) for the specified field(s). |
|
| Returns the number of events in the specified indexes. | |
| Keeps or removes the specified fields.
Default to keeping fields ( | |
| Extracts location information (city, country, continent, ...) for the IP address by using a local copy of the | |
| Displays the least common value of the specified field or the least common combination of values of the specified fields.
With the |
|
| Renames the specified field.
Can be used in a nested | Rename |
| Reverses the order in which events are displayed (more recent to oldest by default). | |
| Sorts results by the specified field(s). The top 10 000 events are returned by default.
The |
|
| Counts the number of events by field or for a combination of the specified fields. | |
| Filters results in the specified timeframe (with |
|
| Filters results based on the specified condition(s) | |
| Displays the timestamps of first and last events from the selection | |
| Filters events if | |
| Extracts a subset - |
Example / useful search queries
Query | Description |
---|---|
| Lists available (non-internal) indexes. |
| Returns the 100th rarest process execution command line (from non-default Windows Security logs). |
| Counts the number of hits on each subdomains of |
| Retrieves the earliest and latest events of each given types for the specified or all index. |
| |
| Searching for the literal character |
| Sort events using another timestamp ( |
|
|
| Displays the timestamps of first and last events as well as the count of total events from the selection by |
Splunk apps
olafhartong's ThreatHunting
The ThreatHunting
Splunk
application contains multiple dashboards, relying on telemetry from Sysmon
and mapped on the MITRE ATT&CK framework
.
The following Splunk
applications must be installed for ThreatHunting
to work:
The Threathunting
application can then be installed. and will index should be configured on the indexers.
References
https://docs.splunk.com/Documentation/SplunkCloud/9.0.2208/SearchReference/ListOfSearchCommands
Last updated