About AnujaJ

AnujaJ · ‎05-25-2020

This does not work. anony_raw overrides anony so the end result is d: 2055XXXXXX. I want to use md5 so that I can still co-relate data-. For props.conf even if I change order of the two properties the end result stays the same. Removing anony_raw makes no changes to the original information.

AnujaJ · ‎05-25-2020

https://answers.splunk.com/answers/614339/transform-field-in-sha256-before-indexation.html suggests this cannot be done.

AnujaJ · ‎05-25-2020

I exactly want this. I changed anony_raw so as to include data before and after. However, the hash is not applied. The script only adds XXX to d instead of calculating hash. props.conf INDEXED_EXTRACTION = json KV_MODE = none TRANSFORMS-anony = anony, anony_raw Transforms.conf [anony] INGEST_EVAL = d=md5(d) WRITE_META = true [anony_raw] REGEX = (?m)^(.*)(\"d\":\s*\")(\d{4})\d+\"(.*) FORMAT = $1$2$3XXXXXX"$4 DEST_KEY =_raw

AnujaJ · ‎05-25-2020

Since the actual data is only available to the admin, does it mean that only admin will create the dashboards while other users use customer index?

AnujaJ · ‎05-25-2020

Thank you for your answer. d is single valued. However, I cannot use this solution as I would not be able to perform commands like "|stats count by d" since the indexed value of d will be changed. I want d to be anonymized for all the users but splunk should be able to internally use it.

AnujaJ · ‎05-22-2020

I have a json event with an id which I want to anonymize. However, I have to be able to perform stats/count/grouping and other analytics on this id later. In short, I want to hide this id for the users but should be able to be used internally by Splunk. Is this possible? My event looks something like this: {"duration":0.33,"a":"login","i":"50050","d":"2055502349","c":"LIVE","@timestamp":"2020-05-22T01:59:59.601Z"} I want to anonymize "d" id.

AnujaJ · ‎11-15-2019

I am uploading the file manually for testing but these settings do not work. Also without FIELD_DELIMITER there is no recognition of different fields. Is it possible to see the effect on manually uploaded file?

AnujaJ · ‎11-12-2019

I have a "!" seperated file without a header. I want to import it in Splunk. However Splunk by default takes the first event as the header and all other events below. I want to manually name the fields in the sourcetype. I was wondering if this is possible. So far, my sourcetype looks like this: [ ca_csv ] SHOULD_LINEMERGE=true LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true CHARSET=UTF-8 DELIMS=! FIELDS=a1,a2,a3,a4,a5 FIELD_DELIMITER=! category=Custom disabled=false pulldown_type=true CHECK_FOR_HEADER=False However, this does not rename the fields as a1,a2,a3,a4,a5. I have 5 fields per event. Sample data L01!0112!11493!20191111000012!1149385630101120002012812019111032019111020191110690952404800415;201911 L02!0112!11493!20191111000012!0003M00BF000001010020191111000012D823AIB000000bR0FFF0001 L03!0112!114938563!20191111000013!0003M0036010001000020191110230005D823O07F L04!0112!114938563!20191111000014!025092664050002011201281201911111000114

AnujaJ · ‎09-30-2019

Go to the next step of Input Settings and come back and you will see the changes. This is a bug.

AnujaJ · ‎06-17-2019

Thank you that works perfectly! 🙂

AnujaJ · ‎06-17-2019

I have two searches : Duration for which a device uses the system index=device | fields device_start_time,device_end_time,device_id, duration, system_id Time for which system is running index=system | fields system_start_time,system_end_time, system_id, system_spec1,sstem_spec2,system_spec3 Now each device runs at different time, each system runs at different time. The multiple devices can subscribe to one running system at a time and assumes the specifications of the system. System have different specifications for different system_start and system_end times. So the results should contain co-related events for each device such that like device_start_time>=system_start_time AND device_end_time<=system_end_time AND system_id matches Final result: device_id,system_id,system_spec1,system_spec2,system_spec3

AnujaJ · ‎06-03-2019

https://docs.splunk.com/Documentation/Splunk/7.2.6/Search/Addsparklinestosearchresults

AnujaJ · ‎05-17-2019

I removed Indexed extractions from the prop.conf on UF. And that resolved my issue.

AnujaJ · ‎04-18-2019

I have these settings on props.conf on UF. Is that the problem that I need to put these settings on SH?

AnujaJ · ‎04-17-2019

This is not a multivalued field. This is a single valued field. All fields except the date field are affected. I want all the fields to appear as single valued field. The json data has getting wrongly doubled values.

Posts	25
Solutions	0
Karma Given	4
Karma Received	4
Member Since	‎07-10-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Anonymize data from JSON File

Importing CSV file without a header

How to join searches based on condition?

Values repeated in each field

Indexing data based on timestamp

Optimize transaction query

Splunk NLTK Tutorial

Re: Anonymize data from JSON File

Re: Anonymize data from JSON File

Re: Anonymize data from JSON File

Re: Anonymize data from JSON File

Re: Anonymize data from JSON File

Anonymize data from JSON File

Re: Importing CSV file without a header

Importing CSV file without a header

Re: PREAMBLE_REGEX

Re: How to join searches based on condition?

How to join searches based on condition?

Re: Add a (sparkline) to a (table)

Re: Values repeated in each field

Re: Values repeated in each field

Re: Values repeated in each field