Archive

Randomizing text?

Champion

I'm looking to obscure data by randomizing text. Does anyone have a simple way to do this against a field in Splunk? Let's assume that I'm doing this to export the data sample. I could eliminate the field altogether, but would like a randomized placeholder, vs just using eval of a fixed value or using random() which is numeric.

0 Karma

SplunkTrust
SplunkTrust

How about this (go get 50 sample events randomly)

your base search | streamstats count as sno | where sno%50=0 | table whateverfield
0 Karma

Esteemed Legend

Does it have to be random?

Start with this:

|makeresults
| eval fieldToObscure="This is organized text of length=35"
| eval len=len(fieldToObscure)

Then try this:

| eval base_string="12345678901234567890123456789012345678901234567890123456789012345678901234567890"
| eval fieldToObscure=substr(base_string, 0, len)

Non-random, but probably seems enough like it to work:

| eval fieldToObscure=substr(md5(fieldToObscure), 0, len)
0 Karma