×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
soe_hlawin
Explorer
Member since: ‎09-05-2013
‎06-05-2020
Community Statistics
Posts 7
Solutions 0
Karma Given 1
Karma Received 3
Member Since ‎09-05-2013
Activity Feed
View All

Re: Anonymize data based on user role

by in Getting Data In
‎10-22-2013 03:15 AM
‎10-22-2013 03:15 AM
Hi, I finally managed to find a way to get the user info to the external lookup script. But this approach doesn't suffice the requirement. As per the said approach, I was supposed to input and output _raw from the lookup script. This is not working, and I doubt if it is feasibile. With a _raw input, I am able to output any other field but not _raw. Any clue? ... View more

Re: Anonymize data based on user role

by in Getting Data In
‎10-16-2013 08:45 PM
‎10-16-2013 08:45 PM
Hi, point noted. But I am unable to retrieve the user/role in the python script to have the logic implemented. To have the user/role in the search results as a field, one has to deliberatly pipe some command. This defeats my purpose for role based masking. Any suggestion about how to send user/role info to the external scripted automated lookup? ... View more

whoami doesn't support external lookup?

by in Splunk Search
‎10-16-2013 03:37 AM
‎10-16-2013 03:37 AM
I have installed the app whoami. when I use it as a command from splunkweb search, it works as expected. But when I want to use this command inside a python script which is invoked from splunkweb search (as an automated external lookup), this returns no search_user field. Moreover, if there is any CLI session on the linux server, the whoami command is returning that user than that of the splunkweb user. Please suggest if there is any way to let whoami know to exclusively retun only the splunkweb user. ... View more

How to identify the logged in user (into splunk we...

by in Security
‎10-14-2013 03:14 AM
‎10-14-2013 03:14 AM
I have a custom script in which I have to perform different actions based on the user who invoked it. The script is a python script. Is there a way I can collect the logged-in user name? I tried the below, which always gives me a None. results,dummyresults,settings = splunk.Intersplunk.getOrganizedResults() owner = settings.get("owner", None) Any other approach or clue would be very much helpful. Thanks in advance. ... View more

Re: Indexed data redirection

by in Splunk Search
‎10-01-2013 11:57 PM
‎10-01-2013 11:57 PM
Ayn, Thanks for clarification. Is there a way to manipulate at indexer lever to have the data in two different indexes? My usecase is to have a index with actual data and another with same data but masked values. ... View more

Indexed data redirection

by in Splunk Search
‎10-01-2013 06:42 PM
‎10-01-2013 06:42 PM
I want to redirection the indexed data into separate index through transforms.conf Post redirection, does the data available in both the indexes or only the new index? Does this redirection consume double the space which ulimately doulbes my licensing cost? ... View more

Anonymize data based on user role

by in Getting Data In
‎09-26-2013 07:32 PM
3 Karma
‎09-26-2013 07:32 PM
3 Karma
How to mask or Anonymize data in Splunk 5.0.4 based on role, such that one role (such as Admin) can search and see the data as it was indexed whereas another (such as User) can search and see only masked data ? ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma from
View All
Karma given to
View All