{"id":3279,"date":"2022-04-10T21:44:48","date_gmt":"2022-04-11T05:44:48","guid":{"rendered":"https:\/\/tungle.ca\/?p=3279"},"modified":"2022-05-04T07:53:20","modified_gmt":"2022-05-04T15:53:20","slug":"using-splunk-to-find-information-on-linux-logs","status":"publish","type":"post","link":"https:\/\/tungle.ca\/?p=3279","title":{"rendered":"Using Splunk to find information on Linux and Windows logs"},"content":{"rendered":"\n<p>Splunk &#8211; Settings &#8211; Data Input &#8211; File Directories &#8211; New Local File and Directory &#8211; Browse to the Linux log file.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1012\" height=\"513\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-686.png\" alt=\"\" class=\"wp-image-3280\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-686.png 1012w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-686-300x152.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-686-768x389.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-686-200x101.png 200w\" sizes=\"auto, (max-width: 1012px) 100vw, 1012px\" \/><\/figure>\n\n\n\n<p>Save as log as linux.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"464\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-687-1024x464.png\" alt=\"\" class=\"wp-image-3281\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-687-1024x464.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-687-300x136.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-687-768x348.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-687-200x91.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-687.png 1040w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"937\" height=\"765\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-688.png\" alt=\"\" class=\"wp-image-3282\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-688.png 937w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-688-300x245.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-688-768x627.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-688-200x163.png 200w\" sizes=\"auto, (max-width: 937px) 100vw, 937px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"805\" height=\"480\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-689.png\" alt=\"\" class=\"wp-image-3283\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-689.png 805w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-689-300x179.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-689-768x458.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-689-200x119.png 200w\" sizes=\"auto, (max-width: 805px) 100vw, 805px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"345\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-690-1024x345.png\" alt=\"\" class=\"wp-image-3284\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-690-1024x345.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-690-300x101.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-690-768x259.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-690-200x67.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-690.png 1150w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"431\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-691-1024x431.png\" alt=\"\" class=\"wp-image-3285\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-691-1024x431.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-691-300x126.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-691-768x323.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-691-200x84.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-691.png 1474w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Count the number of Failed passwords for user root<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"584\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-693-1024x584.png\" alt=\"\" class=\"wp-image-3287\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-693-1024x584.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-693-300x171.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-693-768x438.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-693-200x114.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-693.png 1215w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>sourcetype=\"linux\" Failed password root | stats count<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"653\" height=\"433\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-692.png\" alt=\"\" class=\"wp-image-3286\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-692.png 653w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-692-300x199.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-692-200x133.png 200w\" sizes=\"auto, (max-width: 653px) 100vw, 653px\" \/><\/figure>\n\n\n\n<p>+ Count the number of Failed password except root.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"606\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-694-1024x606.png\" alt=\"\" class=\"wp-image-3288\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-694-1024x606.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-694-300x178.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-694-768x455.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-694-200x118.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-694.png 1238w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>sourcetype=\"linux\" Failed password NOT root | stats count<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"646\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-695-1024x646.png\" alt=\"\" class=\"wp-image-3289\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-695-1024x646.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-695-300x189.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-695-768x485.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-695-200x126.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-695.png 1239w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"607\" height=\"430\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-696.png\" alt=\"\" class=\"wp-image-3290\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-696.png 607w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-696-300x213.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-696-200x142.png 200w\" sizes=\"auto, (max-width: 607px) 100vw, 607px\" \/><figcaption>+ Count the number of IP addresses and show the top 10.<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"500\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-698-1024x500.png\" alt=\"\" class=\"wp-image-3293\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-698-1024x500.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-698-300x146.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-698-768x375.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-698-200x98.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-698.png 1236w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1008\" height=\"612\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-697.png\" alt=\"\" class=\"wp-image-3292\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-697.png 1008w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-697-300x182.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-697-768x466.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-697-200x121.png 200w\" sizes=\"auto, (max-width: 1008px) 100vw, 1008px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1004\" height=\"546\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-699.png\" alt=\"\" class=\"wp-image-3294\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-699.png 1004w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-699-300x163.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-699-768x418.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-699-200x109.png 200w\" sizes=\"auto, (max-width: 1004px) 100vw, 1004px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"778\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-700-1024x778.png\" alt=\"\" class=\"wp-image-3295\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-700-1024x778.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-700-300x228.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-700-768x584.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-700-200x152.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-700.png 1026w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"573\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-701-1024x573.png\" alt=\"\" class=\"wp-image-3296\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-701-1024x573.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-701-300x168.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-701-768x430.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-701-200x112.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-701.png 1168w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"846\" height=\"735\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-702.png\" alt=\"\" class=\"wp-image-3297\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-702.png 846w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-702-300x261.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-702-768x667.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-702-200x174.png 200w\" sizes=\"auto, (max-width: 846px) 100vw, 846px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"577\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-703-1024x577.png\" alt=\"\" class=\"wp-image-3298\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-703-1024x577.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-703-300x169.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-703-768x433.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-703-200x113.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-703.png 1201w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"506\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-704-1024x506.png\" alt=\"\" class=\"wp-image-3299\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-704-1024x506.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-704-300x148.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-704-768x380.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-704-200x99.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-704.png 1480w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"302\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-705-1024x302.png\" alt=\"\" class=\"wp-image-3300\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-705-1024x302.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-705-300x88.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-705-768x226.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-705-200x59.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-705.png 1487w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>sourcetype=linuxlogs NOT 'allurbase' | stats count by IP | head 10<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"483\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-707-1024x483.png\" alt=\"\" class=\"wp-image-3302\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-707-1024x483.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-707-300x142.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-707-768x362.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-707-200x94.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-707.png 1488w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"562\" height=\"626\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-708.png\" alt=\"\" class=\"wp-image-3303\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-708.png 562w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-708-269x300.png 269w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-708-180x200.png 180w\" sizes=\"auto, (max-width: 562px) 100vw, 562px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"454\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-709-1024x454.png\" alt=\"\" class=\"wp-image-3304\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-709-1024x454.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-709-300x133.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-709-768x340.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-709-200x89.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-709.png 1485w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"394\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-711-1024x394.png\" alt=\"\" class=\"wp-image-3306\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-711-1024x394.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-711-300x115.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-711-768x295.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-711-200x77.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-711.png 1272w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>+ show top 5 port number used for ssh2.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"940\" height=\"548\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-713.png\" alt=\"\" class=\"wp-image-3308\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-713.png 940w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-713-300x175.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-713-768x448.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-713-200x117.png 200w\" sizes=\"auto, (max-width: 940px) 100vw, 940px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"627\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-714-1024x627.png\" alt=\"\" class=\"wp-image-3309\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-714-1024x627.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-714-300x184.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-714-768x470.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-714-200x123.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-714.png 1061w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"548\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-715-1024x548.png\" alt=\"\" class=\"wp-image-3310\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-715-1024x548.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-715-300x160.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-715-768x411.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-715-200x107.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-715.png 1191w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"822\" height=\"668\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-716.png\" alt=\"\" class=\"wp-image-3311\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-716.png 822w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-716-300x244.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-716-768x624.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-716-200x163.png 200w\" sizes=\"auto, (max-width: 822px) 100vw, 822px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"825\" height=\"578\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-717.png\" alt=\"\" class=\"wp-image-3312\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-717.png 825w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-717-300x210.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-717-768x538.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-717-200x140.png 200w\" sizes=\"auto, (max-width: 825px) 100vw, 825px\" \/><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>sourcetype=\"linux\" | stats count by sshport | sort count by desc | head 5<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"420\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-718-1024x420.png\" alt=\"\" class=\"wp-image-3313\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-718-1024x420.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-718-300x123.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-718-768x315.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-718-200x82.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-718.png 1491w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"233\" height=\"230\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-719.png\" alt=\"\" class=\"wp-image-3314\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-719.png 233w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-719-200x197.png 200w\" sizes=\"auto, (max-width: 233px) 100vw, 233px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"535\" height=\"441\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-720.png\" alt=\"\" class=\"wp-image-3315\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-720.png 535w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-720-300x247.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-720-200x165.png 200w\" sizes=\"auto, (max-width: 535px) 100vw, 535px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"473\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-721-1024x473.png\" alt=\"\" class=\"wp-image-3316\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-721-1024x473.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-721-300x139.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-721-768x355.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-721-200x92.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-721.png 1498w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"521\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-722-1024x521.png\" alt=\"\" class=\"wp-image-3317\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-722-1024x521.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-722-300x153.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-722-768x391.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-722-200x102.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-722.png 1295w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>+ show top 5 port number used for ssh2<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"322\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-726-1024x322.png\" alt=\"\" class=\"wp-image-3321\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-726-1024x322.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-726-300x94.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-726-768x241.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-726-200x63.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-726.png 1480w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"549\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-727-1024x549.png\" alt=\"\" class=\"wp-image-3322\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-727-1024x549.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-727-300x161.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-727-768x412.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-727-200x107.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-727.png 1033w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"990\" height=\"619\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-728.png\" alt=\"\" class=\"wp-image-3323\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-728.png 990w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-728-300x188.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-728-768x480.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-728-200x125.png 200w\" sizes=\"auto, (max-width: 990px) 100vw, 990px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"856\" height=\"502\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-729.png\" alt=\"\" class=\"wp-image-3324\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-729.png 856w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-729-300x176.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-729-768x450.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-729-200x117.png 200w\" sizes=\"auto, (max-width: 856px) 100vw, 856px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1013\" height=\"526\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-730.png\" alt=\"\" class=\"wp-image-3325\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-730.png 1013w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-730-300x156.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-730-768x399.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-730-200x104.png 200w\" sizes=\"auto, (max-width: 1013px) 100vw, 1013px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"598\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-731-1024x598.png\" alt=\"\" class=\"wp-image-3326\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-731-1024x598.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-731-300x175.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-731-768x448.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-731-200x117.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-731.png 1057w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"551\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-732-1024x551.png\" alt=\"\" class=\"wp-image-3327\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-732-1024x551.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-732-300x161.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-732-768x413.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-732-200x108.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-732.png 1181w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>sourcetype=\"linux\" session opened for user | stats count by user | sort count desc | head 5 \n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"420\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-733-1024x420.png\" alt=\"\" class=\"wp-image-3328\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-733-1024x420.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-733-300x123.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-733-768x315.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-733-200x82.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-733.png 1485w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Import Windows log file.<\/p>\n\n\n\n<p>source=&#8221;windows_perfmon_logs.txt&#8221; | stats count by collection | where count>100 | sort collection desc<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"555\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-734-1024x555.png\" alt=\"\" class=\"wp-image-3329\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-734-1024x555.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-734-300x162.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-734-768x416.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-734-200x108.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-734.png 1481w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>+ Count ComputerName start with acme and sort by desc.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>source=\"windows_perfmon_logs.txt\" ComputerName=\"acme*\" | stats count by ComputerName | sort count desc<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"431\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-735-1024x431.png\" alt=\"\" class=\"wp-image-3330\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-735-1024x431.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-735-300x126.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-735-768x323.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-735-200x84.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-735.png 1489w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Splunk &#8211; Settings &#8211; Data Input &#8211; File Directories &#8211; New Local File and Directory &#8211; Browse to the Linux log file. Save as log as linux. Count the number of Failed passwords for user root + Count the number of Failed password except root. + show top 5 port number used for ssh2. + [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11],"tags":[33],"class_list":["post-3279","post","type-post","status-publish","format-standard","hentry","category-security","tag-splunk"],"_links":{"self":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/3279","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3279"}],"version-history":[{"count":5,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/3279\/revisions"}],"predecessor-version":[{"id":3741,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/3279\/revisions\/3741"}],"wp:attachment":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3279"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3279"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3279"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}