Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About johnhsu
johnhsu
Observer
Member since:
04-21-2011
05-04-2023
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-21-2011 |
Activity Feed
- Posted Two tables with same field name, got response status=400. Resolved by change one of the same field name to different name. on All Apps and Add-ons. 12-31-2018 09:53 AM
- Tagged Two tables with same field name, got response status=400. Resolved by change one of the same field name to different name. on All Apps and Add-ons. 12-31-2018 09:53 AM
- Tagged Two tables with same field name, got response status=400. Resolved by change one of the same field name to different name. on All Apps and Add-ons. 12-31-2018 09:53 AM
- Posted Re: License exception thrown when trying to explore data on Installation. 09-01-2017 12:05 PM
- Posted Re: Masking SSN info into splunk at index time on Getting Data In. 02-07-2014 10:23 AM
- Posted Re: Masking SSN info into splunk at index time on Getting Data In. 02-07-2014 10:06 AM
- Posted Re: Masking SSN info into splunk at index time on Getting Data In. 02-07-2014 09:41 AM
- Posted Re: Session lock files on Security. 10-04-2013 10:45 AM
- Posted Re: excessive session lock files using up inodes on Deployment Architecture. 10-04-2013 10:19 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
12-31-2018
09:53 AM
Two tables with same field name issue.
PowerShell will automatically rename the second name with suffix number.
In SolarWinds Add-on for Splunk, two tables with same field name will got response status=400
Resolved by change one of the same field name to different name.
For example:
SELECT CN.NodeID, CN.SysName, N.IPAddress, N.SysName as Node_SysName FROM Cirrus.Nodes AS CN LEFT JOIN Orion.Nodes AS N ON CN.CoreNodeID = N.NodeID
... View more
09-01-2017
12:05 PM
I have same issue with Version 6.6.2 and 6.6.3
... View more
02-07-2014
10:23 AM
Sorry! Try again
should be
REGEX = (?ms)^(.\*)\<[sS]ocialSecurityNumber>\d{3}-?\d{2}-?(\d{4}.\*)$
Thanks
Sincerely
John Hsu
... View more
02-07-2014
10:06 AM
Corrected: Don't know why missed the star "" after those two dot in post
Try post again:
"REGEX = (?ms)^(.)<[sS]ocialSecurityNumber>\d{3}-?\d{2}-?(\d{4}.*)$"
Thanks
Sincerely
John Hsu
... View more
02-07-2014
09:41 AM
Regex for masking Social Security Number in XML TAG
Result:
<relatedPolicies />
<socialSecurityNumber>###-##-1234</socialSecurityNumber>
<ssnRefusedIndicator>false</ssnRefusedIndicator>
transforms.conf:
[SSN-anonymizer]
REGEX = (?ms)^(.*)\<[sS]ocialSecurityNumber>\d{3}-?\d{2}-?(\d{4}.*)$
FORMAT = $1<socialSecurityNumber>###-##-$2
DEST_KEY = _raw
Note:
In Splunk V6.0.1
In my testing, masking function failed if the record is very large, for example 15KB, and SSB is out of 100 lines (or some position) .
Thanks
Sincerely
John Hsu
... View more
10-04-2013
10:45 AM
Remove tons of session files
ll | grep session | awk '{print "rm "$8" "}' | csh
Note:
"$8" -- column 8 of ll comand
Thanks
Sincerely
John Hsu
... View more
10-04-2013
10:19 AM
Remove tons of session files
ll | grep session | awk '{print "rm "$8" "}' | csh
Note:
"$8" -- column 8 of ll comand
Thanks
Sincerely
John Hsu
johnthsu@hotmail.com
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-04-2023
03:27 PM
|
