How can I use sha1 in my Splunk search

[pk87]

We save hash values from our ids and I want to search for them. I would expected I can do it this way:

index=blub id=sha1("11122233") 

But unfurtonaly it doesn't work. Also other attemps failed (for exampe to eval it first in a new variable). If I just use the sha1 it return the correct value, but somehow it doesn't work in the search. 

Can anybody help here or has suggestion. 

[ITWhisperer]

index=blub
| where id=sha1("11122233")

[pk87]

I tried this, but don' get results

index=blub sourcetype=blub:nadev | where properties.id = sha1("SNL123456789454651")

[ITWhisperer]

That would seem to suggest that properties.id does not contain the sha1 of "SNL123456789454651", at least not as the only thing in it.

Do you have some example event you can share which are not being found when they should?

[pk87]

[ITWhisperer · Accepted solution]

index=blub
| id=sha1("11122233")
| where 'properties.id'=id

[pk87]

I am not able to find anything with the where statement. Even if I use directly the hash value.

So this works:

index=rtt properties.vin = "d7a4acc844c8176009371c65c63bd07c929d4738"

but this doesn't:

index=rtt | where properties.vin = "d7a4acc844c8176009371c65c63bd07c929d4738"

[pk87]

I missed this part. now it works!

index=rtt | where 'properties.vin' = sha1("SNL23456789185206")

[ITWhisperer]

Try with the field name in single quotes (as I showed in my example)

[pk87]

I missed this part. now it works!

index=rtt | where 'properties.vin' = sha1("SNL23456789185206")