DNS search for encoded data

Description: Use this Splunk search to find Base64 encoded content in DNS queries. The goal is to examine the DNS query field of the dns events to find subdomain streams that contain only Base64 valid characters. Utilizing DNS queries with encoded information is a known method to exfiltrate data. But you do not know if […]

Continue Reading →

Show cron frequency and scheduling of all scheduled searches

This search shows you all scheduled searches and their respective cron frequency and cron schedule. This also helps finding frequently running saved searches.

Continue Reading →

Data model Acceleration Details

This Splunk Search shows you a lot of good information about your data model acceleration and performance.

 

Continue Reading →

Remove mulitple values from a multivalue field

This Splunk search is an example on how to remove unwanted values from multivalue fields using mvfilter.

Continue Reading →

List all your existing indexes or check if index exists

With this spl you can check what indexes exist or if you want to search for a specific index. List all indexes:

Or check if a specific index exist use:

Continue Reading →

Datamodel Search Performance

See how well your DM searches are running. Run this search using the Line Chart visualization:

Continue Reading →

Breathing Fire Dragon when Starting dbx_task_server

Will return events that display a little dragon ascii art:

Continue Reading →

Show your triggered alerts

This search shows all the alerts that where triggered in your splunk environment:

Continue Reading →

Find unused dashboards

Use this search to find unused dashboards:

Admin Notes – Fantastic query! I modified the SPL slightly as I had an issue when I copied it to my two test environments.

Continue Reading →

Saved Search Scheduler Activity

I use this query a lot to tune and adjust scheduling, find out what searches need attention:

 

Continue Reading →

Show indexing queue sizes

Use a linechart with this search to show you the indexing queue sizes:

Continue Reading →

Percentage of skipped searches

This query will give you a table with a percentage of skipped searches and an evaluation with 3 ranges

Continue Reading →

Retention Period in days per index

This query will give you a table of all indexes and their respective retention period in days:

Continue Reading →

Bucket Count by indexer/index

This search displays the amount of buckets per indexer/index To learn more about the | dbinspect command go to: http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Dbinspect

Continue Reading →

Bucket Count by State over Index

This search counts the amount of buckets per state for each index. To learn more about | dbinspect go to: http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Dbinspect

Continue Reading →

Memory Usage (MB) per Splunk Process Class

Use the following search with a column chart visualisation. It will give you a good overview of what Splunk processes use the most memory:

Continue Reading →

Universal Forwarder Throughput Limit Hit Count

This search counts the amount of times the UF’s throughput limit is hit. I also threw in a sparkline:

Continue Reading →

Top 10 Accessed Dashboards

Where “host=”your_sh_host”” you could specify a host, or put a wildcard * in place.

Continue Reading →