About pk87

pk87 · ‎12-13-2021

I missed this part. now it works! index=rtt | where 'properties.vin' = sha1("SNL23456789185206")

pk87 · ‎12-13-2021

I missed this part. now it works! index=rtt | where 'properties.vin' = sha1("SNL23456789185206")

pk87 · ‎12-13-2021

I am not able to find anything with the where statement. Even if I use directly the hash value. So this works: index=rtt properties.vin = "d7a4acc844c8176009371c65c63bd07c929d4738" but this doesn't: index=rtt | where properties.vin = "d7a4acc844c8176009371c65c63bd07c929d4738"

pk87 · ‎12-13-2021

pk87 · ‎12-13-2021

I tried this, but don' get results index=blub sourcetype=blub:nadev | where properties.id = sha1("SNL123456789454651")

pk87 · ‎12-13-2021

We save hash values from our ids and I want to search for them. I would expected I can do it this way: index=blub id=sha1("11122233") But unfurtonaly it doesn't work. Also other attemps failed (for exampe to eval it first in a new variable). If I just use the sha1 it return the correct value, but somehow it doesn't work in the search. Can anybody help here or has suggestion.

Posts	6
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎12-13-2021

Online Status	Offline
Date Last Visited	‎12-13-2021 10:57 AM

How can I use sha1 in my Splunk search

Re: How can I use sha1 in my Splunk search

Re: How can I use sha1 in my Splunk search

Re: How can I use sha1 in my Splunk search

Re: How can I use sha1 in my Splunk search

Re: How can I use sha1 in my Splunk search

How can I use sha1 in my Splunk search