First time seen JA3/JA3s hashes. You can run a search which uses JA3 and JA3s hashes to detect abnormal activity on critical servers which are often targeted in supply chain attacks. JA3 is an open-source methodology that allows for creating an MD5 hash of specific values found in the SSL/TLS handshake process, and JA3s is a similar methodology. Source type your TSV Bro logs as bro and your JSON logs bro:json via Settings > Data Inputs > Files & Directories Your timestamp is automatically converted to Splunk epoch time format Browse other questions tagged json parsing terraform splunk amazon-kinesis-firehose or ask your own question Browse other questions tagged json parsing terraform splunk amazon. The Splunk Web Framework represents a search using a search manager. You can think of a search manager like a wrapper around a search that includes the search query (for example, "index=main | head 100 | timechart count by sourcetype") and the properties of the search (for example, the search mode or the time range to search).The search manager handles the operation of the search (start.