Is there a way to define a maximum size for all tsidx files generated in tsidxstats directory using tscollect command. Could find any settings in indexes.conf or any other config file. According to the documentaition it's an currently unsupported command but the PAN app uses this feature. ... View more

I want to anonymize user data (for example email adresses) at searchtime and tried a couple of ways. I tried the rex command rex mode=sed "s/(\w+.?\w+?)@mydoamin.net/xxxxx@mydomain.net/g" which works but does not modify the raw event at search time. The result is, that if a user selects "show source" he can see the original mail address again. Also a defined field will show the original mail address. The other problem is, that all the reports a boring because all our internal mail adresses will be replaced with xxxxx. I'm looking for some way replace the username of the mail address with a hash code of the username. But could not find anything like this. I also saw in the splunkbase a solution to do a des or 3des encryption of a specific field (http://splunk-base.splunk.com/apps/22393/encrypt-and-decrypt-data-within-events) but this will not work in my environment because all events came in from forwarders or by syslog and on the forwarders I'm not allowed to install such functions because of performance issues. In version 4.2 I found a new command mappy which allows to run short python scripts but looks like it does not support all python modules and options. I tried to use mappy and the python command re.sub but could not find any working "one line" command which will replace the string extracted by the rex with it's hash code. Does anyone found a way to anonymize user data in splunk with hash codes or something like this. ... View more

Hi, I want to customize the default search view (the flashtimeline view) and insert a text fields which will be used for a hiddenintention to allow my users to optionaly specify host in the textfield. I used the module textsetting to insert the addterm. This works fine but there is no way to define default value which will be used if the user does not insert a host or source type in the textbox. I also tried to use ExtendedFieldSearch module where a defaut value could be defined but as far as I understand this module it only passes the value of the text filed to the addterm - but I need to pass a prefix to (for example: textfield contains "host1" but host="host1" should be added as addterm). Does anyone have an idea how to insert a default value in the TextSetting module or how to add a prefix to the addterm in the ExtendedSearchField module. I attached both parts of my xml file: xml for the HiddenIntention with TextSetting: <module name="HiddenIntention"> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="index=>myindex</param> </param> </param> <module name="TextSetting"> <param name="elementName">host_elem</param> <param name="settingName">host_value</param> <param name="label">Application Server</param> <module name="ConvertToIntention"> <param name="settingToConvert">host_value</param> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="host">$target$</param> </param> </param> And now the one with ExtendedFieldSearch <module name="HiddenIntention"> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="index=>myindex</param> </param> </param> <module name="ExtendedFieldSearch"> <param name="replacementMap"> <param name="arg"/> </param> <param name="intention"> <param name="name">addterm</param> <param name="arg"/> </param> <param name="default">*</param> <param name="field">Sourcetype</param> Thanks Christian ... View more