https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-define-multiple-evals-as-default-for-each/m-p/464937#M131004 <P>@HeinzWaescher </P> <P>I think it is not possible. But to achieve this, you have to create a <CODE>macro</CODE> with below search which can be use in all searches.</P> <PRE><CODE>| eval _raw=split(_raw, user) | eval user_hash=sha256(user) | eval _raw=mvjoin(_raw, user_hash) </CODE></PRE> <P>Like: </P> <PRE><CODE>search index=main `my_macro` </CODE></PRE> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.3.2/Knowledge/Definesearchmacros">https://docs.splunk.com/Documentation/Splunk/7.3.2/Knowledge/Definesearchmacros</A></P> Wed, 23 Oct 2019 07:00:11 GMT kamlesh_vaghela 2019-10-23T07:00:11Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-define-multiple-evals-as-default-for-each/m-p/464936#M131003 <P>Hi,</P> <P>I would like to know whether it is possible to perform something like this per default for each and every search in the background:</P> <P>| eval _raw=split(_raw, user)<BR /> | eval user_hash=sha256(user)<BR /> | eval _raw=mvjoin(_raw, user_hash)</P> <P>Thanks in advance</P> Wed, 30 Sep 2020 02:40:54 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-define-multiple-evals-as-default-for-each/m-p/464936#M131003 HeinzWaescher 2020-09-30T02:40:54Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-define-multiple-evals-as-default-for-each/m-p/464937#M131004 <P>@HeinzWaescher </P> <P>I think it is not possible. But to achieve this, you have to create a <CODE>macro</CODE> with below search which can be use in all searches.</P> <PRE><CODE>| eval _raw=split(_raw, user) | eval user_hash=sha256(user) | eval _raw=mvjoin(_raw, user_hash) </CODE></PRE> <P>Like: </P> <PRE><CODE>search index=main `my_macro` </CODE></PRE> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.3.2/Knowledge/Definesearchmacros">https://docs.splunk.com/Documentation/Splunk/7.3.2/Knowledge/Definesearchmacros</A></P> Wed, 23 Oct 2019 07:00:11 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-define-multiple-evals-as-default-for-each/m-p/464937#M131004 kamlesh_vaghela 2019-10-23T07:00:11Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-define-multiple-evals-as-default-for-each/m-p/464938#M131005 <P>I thought about using macros. But I would like have a solution that the user don't have to use actively.<BR /> It should be done by default for a defined role.</P> Wed, 23 Oct 2019 07:04:55 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-define-multiple-evals-as-default-for-each/m-p/464938#M131005 HeinzWaescher 2019-10-23T07:04:55Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-define-multiple-evals-as-default-for-each/m-p/464939#M131006 <P>If you know the user,</P> <PRE><CODE>user user_hash </CODE></PRE> <P>It would be nice to create a CSV with the value of and auto lookup</P> Sat, 26 Oct 2019 00:54:18 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-define-multiple-evals-as-default-for-each/m-p/464939#M131006 to4kawa 2019-10-26T00:54:18Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-define-multiple-evals-as-default-for-each/m-p/464940#M131007 <P>before i go further, your search is very heavy as it calculates all data and hashes user, if you want to mask the user field, you can do it at index time with <CODE>props.conf</CODE> and <CODE>tranforms.conf</CODE> also, check out the new feature in Splunk 8.0 around work with data before its indexed<BR /> i think the closest to what you are after is: "search filters" however, although they have some downsides, <BR /> read here:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/8.0.0/Security/Addandeditroles#Specify_search_restrictions_for_a_role">https://docs.splunk.com/Documentation/Splunk/8.0.0/Security/Addandeditroles#Specify_search_restrictions_for_a_role</A><BR /> there is another doc that i cant find at the moment.<BR /> regardless, i think that what @kamlesh_vaghela suggested (macros) is a better solution, as you will can also put variables in them and they are knowledge objects and not roles configuration.</P> <P>hope it helps</P> Sat, 26 Oct 2019 01:53:31 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-define-multiple-evals-as-default-for-each/m-p/464940#M131007 adonio 2019-10-26T01:53:31Z