Splunk Search

Is it possible to define multiple evals as default for each search?

HeinzWaescher
Motivator

Hi,

I would like to know whether it is possible to perform something like this per default for each and every search in the background:

| eval _raw=split(_raw, user)
| eval user_hash=sha256(user)
| eval _raw=mvjoin(_raw, user_hash)

Thanks in advance

Tags (2)
0 Karma

adonio
Ultra Champion

before i go further, your search is very heavy as it calculates all data and hashes user, if you want to mask the user field, you can do it at index time with props.conf and tranforms.conf also, check out the new feature in Splunk 8.0 around work with data before its indexed
i think the closest to what you are after is: "search filters" however, although they have some downsides,
read here:
https://docs.splunk.com/Documentation/Splunk/8.0.0/Security/Addandeditroles#Specify_search_restricti...
there is another doc that i cant find at the moment.
regardless, i think that what @kamlesh_vaghela suggested (macros) is a better solution, as you will can also put variables in them and they are knowledge objects and not roles configuration.

hope it helps

to4kawa
Ultra Champion

If you know the user,

user user_hash

It would be nice to create a CSV with the value of and auto lookup

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@HeinzWaescher

I think it is not possible. But to achieve this, you have to create a macro with below search which can be use in all searches.

| eval _raw=split(_raw, user)
| eval user_hash=sha256(user)
| eval _raw=mvjoin(_raw, user_hash)

Like:

search index=main `my_macro`

https://docs.splunk.com/Documentation/Splunk/7.3.2/Knowledge/Definesearchmacros

HeinzWaescher
Motivator

I thought about using macros. But I would like have a solution that the user don't have to use actively.
It should be done by default for a defined role.

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...