topic Can I replace a field at parsing stage with a hash (using sha2 for example)? in Getting Data In

Can I replace a field at parsing stage with a hash (using sha2 for example)?

_karlo — Fri, 12 Jan 2018 03:47:15 GMT

Hi answers! I would like to replace some information I get in Splunk.
For example, I get some user names (user=karlo) for example. I would like to replace this with a hash value.

I have learned about SEDCMD and transforms. In there I know I can replace some characters with XXXX-es. This will not do in this case.

Replacing the values with a hash, before getting indexed/written to disk, and using my own salt, would be very nice. Can someone provide me with a hint if this is possible, and if so: how to do it?

Re: Can I replace a field at parsing stage with a hash (using sha2 for example)?

micahkemp — Fri, 12 Jan 2018 03:55:43 GMT

There is no way to run code at index time once the event is presented to Splunk. So, monitor inputs, etc have no way to do this.

But, if the necessity to accomplish this exists, you can look into scripted or modular inputs to meet this need.

Basically you would write code that reads the file and does the replacement, and Splunk would call that code.

Re: Can I replace a field at parsing stage with a hash (using sha2 for example)?

_karlo — Fri, 12 Jan 2018 04:04:25 GMT

Thanks for your reply. That is unfortunate. I will wait for a shot time if someone else has some answer, and accept next week if there is no other way. Thanks.

Re: Can I replace a field at parsing stage with a hash (using sha2 for example)?

micahkemp — Fri, 12 Jan 2018 04:06:28 GMT

I, too, hope my answer proves to be wrong. 🙂

Re: Can I replace a field at parsing stage with a hash (using sha2 for example)?

niketn — Fri, 12 Jan 2018 04:52:18 GMT

@_karlo, you can refer to Nimish Doshi's App on Splunkbase Encrypt and Decrypt data within Events. You can also check out his blog: https://www.splunk.com/blog/2010/01/25/encrypting-and-decrypting-fields.html

Re: Can I replace a field at parsing stage with a hash (using sha2 for example)?

stuartidelta01 — Wed, 28 Nov 2018 23:47:26 GMT

Note that this is now possible in Splunk 7.2 with the new ingest eval capability.

You can, for instance, apply the eval sha512 function to a field to create a new field:

https://docs.splunk.com/Documentation/Splunk/7.2.0/Data/IngestEval