About AnujaJ

AnujaJ · ‎05-25-2020

This does not work. anony_raw overrides anony so the end result is d: 2055XXXXXX. I want to use md5 so that I can still co-relate data-. For props.conf even if I change order of the two properties the end result stays the same. Removing anony_raw makes no changes to the original information.

AnujaJ · ‎05-25-2020

https://answers.splunk.com/answers/614339/transform-field-in-sha256-before-indexation.html suggests this cannot be done.

AnujaJ · ‎05-25-2020

I exactly want this. I changed anony_raw so as to include data before and after. However, the hash is not applied. The script only adds XXX to d instead of calculating hash. props.conf INDEXED_EXTRACTION = json KV_MODE = none TRANSFORMS-anony = anony, anony_raw Transforms.conf [anony] INGEST_EVAL = d=md5(d) WRITE_META = true [anony_raw] REGEX = (?m)^(.*)(\"d\":\s*\")(\d{4})\d+\"(.*) FORMAT = $1$2$3XXXXXX"$4 DEST_KEY =_raw

AnujaJ · ‎05-25-2020

Since the actual data is only available to the admin, does it mean that only admin will create the dashboards while other users use customer index?

AnujaJ · ‎05-25-2020

Thank you for your answer. d is single valued. However, I cannot use this solution as I would not be able to perform commands like "|stats count by d" since the indexed value of d will be changed. I want d to be anonymized for all the users but splunk should be able to internally use it.

AnujaJ · ‎05-22-2020

I have a json event with an id which I want to anonymize. However, I have to be able to perform stats/count/grouping and other analytics on this id later. In short, I want to hide this id for the users but should be able to be used internally by Splunk. Is this possible? My event looks something like this: {"duration":0.33,"a":"login","i":"50050","d":"2055502349","c":"LIVE","@timestamp":"2020-05-22T01:59:59.601Z"} I want to anonymize "d" id.

AnujaJ · ‎11-15-2019

I am uploading the file manually for testing but these settings do not work. Also without FIELD_DELIMITER there is no recognition of different fields. Is it possible to see the effect on manually uploaded file?

AnujaJ · ‎11-12-2019

I have a "!" seperated file without a header. I want to import it in Splunk. However Splunk by default takes the first event as the header and all other events below. I want to manually name the fields in the sourcetype. I was wondering if this is possible. So far, my sourcetype looks like this: [ ca_csv ] SHOULD_LINEMERGE=true LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true CHARSET=UTF-8 DELIMS=! FIELDS=a1,a2,a3,a4,a5 FIELD_DELIMITER=! category=Custom disabled=false pulldown_type=true CHECK_FOR_HEADER=False However, this does not rename the fields as a1,a2,a3,a4,a5. I have 5 fields per event. Sample data L01!0112!11493!20191111000012!1149385630101120002012812019111032019111020191110690952404800415;201911 L02!0112!11493!20191111000012!0003M00BF000001010020191111000012D823AIB000000bR0FFF0001 L03!0112!114938563!20191111000013!0003M0036010001000020191110230005D823O07F L04!0112!114938563!20191111000014!025092664050002011201281201911111000114

AnujaJ · ‎09-30-2019

Go to the next step of Input Settings and come back and you will see the changes. This is a bug.

AnujaJ · ‎06-17-2019

Thank you that works perfectly! 🙂

AnujaJ · ‎06-17-2019

I have two searches : Duration for which a device uses the system index=device | fields device_start_time,device_end_time,device_id, duration, system_id Time for which system is running index=system | fields system_start_time,system_end_time, system_id, system_spec1,sstem_spec2,system_spec3 Now each device runs at different time, each system runs at different time. The multiple devices can subscribe to one running system at a time and assumes the specifications of the system. System have different specifications for different system_start and system_end times. So the results should contain co-related events for each device such that like device_start_time>=system_start_time AND device_end_time<=system_end_time AND system_id matches Final result: device_id,system_id,system_spec1,system_spec2,system_spec3

AnujaJ · ‎06-03-2019

https://docs.splunk.com/Documentation/Splunk/7.2.6/Search/Addsparklinestosearchresults

AnujaJ · ‎05-17-2019

I removed Indexed extractions from the prop.conf on UF. And that resolved my issue.

AnujaJ · ‎04-18-2019

I have these settings on props.conf on UF. Is that the problem that I need to put these settings on SH?

AnujaJ · ‎04-17-2019

This is not a multivalued field. This is a single valued field. All fields except the date field are affected. I want all the fields to appear as single valued field. The json data has getting wrongly doubled values.

AnujaJ · ‎04-17-2019

index=kpi sourcetype=kpi_json

AnujaJ · ‎04-17-2019

I am getting repeated values in Splunk fields. This can be seen only in Table view. For list view/raw there is no repetition seen. However, my search queries treat all these fields as multi-valued fields. I do not want the repeated values in the single valued field. Values in Splunk Props.conf [kpi_json] CHARSET=UTF-8 INDEXED_EXTRACTIONS=json KV_MODE=none SHOULD_LINEMERGE=true category=Structured description=JavaScript Object Notation format. For more information, visit http://json.org/ disabled=false pulldown_type=true LINE_BREAKER=([\r\n]+) TZ=Europe/Berlin TIMESTAMP_FIELDS=@timestamp

AnujaJ · ‎03-06-2019

newList=[] data_list=json.loads(str) date_now=datetime.datetime.now().strftime("%d-%b-%Y") hour_now=datetime.datetime.now().hour-1 for element in data_list: date=datetime.datetime.strptime(element['usage_timestamp'],"%d-%b-%Y %H:%M:%S").date().strftime("%d-%b-%Y") hour=datetime.datetime.strptime(element['usage_timestamp'],"%d-%b-%Y %H:%M:%S").hour if date==date_now and hour==hour_now: newList.append(element) data=json.dumps(newList)

AnujaJ · ‎03-06-2019

I would like to confirm my approach based on your advice. I found rest.py in bin of the app. Mostly "data" field in this python script looks like the one I need to modify. The flowchart looks to me like: 1. Take data field and covert it into dictionary. 2. For each element of this dictionary do a date and time check. 3. Create a new dictionary with only the required timestamps (latest in this case) 4. Convert this dictionary into json object 5. set this json object as data variable

AnujaJ · ‎03-05-2019

I am using REST App (https://www.splunk.com/blog/2013/06/18/getting-data-from-your-rest-apis-into-splunk.html# ) to get data into Splunk. The App works well but my REST Api sends all the data from the day and I want to ingest only the data from last 1 hour. So I would like to filter events based on timestamp and not re-ingest the same data again. I am not sure how can I do this filtering before the data is indexed. I checked transforms.conf however except for REGEX filtering I could not find timestamp filtering.

AnujaJ · ‎03-05-2019

Here: https://www.splunk.com/blog/2013/06/18/getting-data-from-your-rest-apis-into-splunk.html# I used this App. Very simple to configure.

AnujaJ · ‎01-09-2019

I did step 14,15 (coalesce) before I did stats(step 11) so that he counts the evicted results as well. And instead of range I just use eval to substract time between logout and login. Somehow range was not able to calculate the correct duration. Thank you for your help.

AnujaJ · ‎12-21-2018

index=shop sourcetype="shop1" (component=logout) OR (component=login) Id1!=NULL |transaction Id1,Id2 startswith=login endswith=logout keepevicted=true |table Id1,Id2,api,duration,_time,evicted |fillnull value=0 | eval l_time=relative_time(now(),"-15m") | eval duration=if(match(api,"logout"),_time-l_time,if(match(api,"login"),now()-max(_time),duration)) | convert dur2sec(duration) AS duration | search duration>360 |table Id1,Id2,api,duration |stats sum(duration) as watch_time, count(Id1) as total_Ids by Id2 |eventstats sum(total_Ids) as total |eval total_time =round(time/60,2),quoten=(total_Ids/total)*100 |eval average=total_time/total_Ids |lookup userLookup Id2 as Id2 OUTPUT username as username |table Id2, username,total_time, total_Ids,quoten,average | sort -quoten

AnujaJ · ‎12-20-2018

Hello I have a transaction query which I would like to optimize. It is impossible to run the query for a few hours. Is there anyway I can rephrase the query to have the same results? Query: transaction Id1,Id2 startswith=login endswith=logout keepevicted=true A unique event is mapped by combination of Id1 and Id2 I want to map all users who have logged in and logged out in the window Also all users who have logged in but not logged out And finally users who have logged out in the given time frame. I am not sure how can I use subsearches or xyseries to optimize this query.

AnujaJ · ‎07-10-2018

Hello, I installed Splunk NLTK App for raw text analysis. However, I cannot find any tutorial or guideline on how to use the app. Does anyone have an idea on how to use it? App Link: https://splunkbase.splunk.com/app/4057/#/details

Posts	25
Solutions	0
Karma Given	4
Karma Received	4
Member Since	‎07-10-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Anonymize data from JSON File

Importing CSV file without a header

How to join searches based on condition?

Values repeated in each field

Indexing data based on timestamp

Optimize transaction query

Splunk NLTK Tutorial

Re: Anonymize data from JSON File

Re: Anonymize data from JSON File

Re: Anonymize data from JSON File

Re: Anonymize data from JSON File

Re: Anonymize data from JSON File

Anonymize data from JSON File

Re: Importing CSV file without a header

Importing CSV file without a header

Re: PREAMBLE_REGEX

Re: How to join searches based on condition?

How to join searches based on condition?

Re: Add a (sparkline) to a (table)

Re: Values repeated in each field

Re: Values repeated in each field

Re: Values repeated in each field

Re: Values repeated in each field

Values repeated in each field

Re: Indexing data based on timestamp

Re: Indexing data based on timestamp

Indexing data based on timestamp

Re: How to use the REST API to fetch and filter re...

Re: Optimize transaction query

Re: Optimize transaction query

Optimize transaction query

Splunk NLTK Tutorial