topic Re: How can I use sha1 in my Splunk search in Splunk Search

How can I use sha1 in my Splunk search

pk87 — Mon, 13 Dec 2021 12:32:17 GMT

We save hash values from our ids and I want to search for them. I would expected I can do it this way:

index=blub id=sha1("11122233")

But unfurtonaly it doesn't work. Also other attemps failed (for exampe to eval it first in a new variable). If I just use the sha1 it return the correct value, but somehow it doesn't work in the search.

Can anybody help here or has suggestion.

Re: How can I use sha1 in my Splunk search

ITWhisperer — Mon, 13 Dec 2021 13:00:02 GMT

index=blub | where id=sha1("11122233")

Re: How can I use sha1 in my Splunk search

pk87 — Mon, 13 Dec 2021 13:08:15 GMT

I tried this, but don' get results

index=blub sourcetype=blub:nadev | where properties.id = sha1("SNL123456789454651")

Re: How can I use sha1 in my Splunk search

ITWhisperer — Mon, 13 Dec 2021 13:16:23 GMT

That would seem to suggest that properties.id does not contain the sha1 of "SNL123456789454651", at least not as the only thing in it.

Do you have some example event you can share which are not being found when they should?

Re: How can I use sha1 in my Splunk search

pk87 — Mon, 13 Dec 2021 13:27:10 GMT

Re: How can I use sha1 in my Splunk search

ITWhisperer — Mon, 13 Dec 2021 13:38:13 GMT

index=blub | id=sha1("11122233") | where 'properties.id'=id

Re: How can I use sha1 in my Splunk search

pk87 — Mon, 13 Dec 2021 14:15:40 GMT

I am not able to find anything with the where statement. Even if I use directly the hash value.

So this works:

index=rtt properties.vin = "d7a4acc844c8176009371c65c63bd07c929d4738"

but this doesn't:

index=rtt | where properties.vin = "d7a4acc844c8176009371c65c63bd07c929d4738"

Re: How can I use sha1 in my Splunk search

ITWhisperer — Mon, 13 Dec 2021 14:17:57 GMT

Try with the field name in single quotes (as I showed in my example)

Re: How can I use sha1 in my Splunk search

pk87 — Mon, 13 Dec 2021 14:22:41 GMT

I missed this part. now it works!

index=rtt | where 'properties.vin' = sha1("SNL23456789185206")

Re: How can I use sha1 in my Splunk search

pk87 — Mon, 13 Dec 2021 15:29:17 GMT

I missed this part. now it works!

index=rtt | where 'properties.vin' = sha1("SNL23456789185206")