topic Re: Data masking in Getting Data In

Could someone help me with Data Masking?

egcp — Mon, 19 Sep 2022 15:41:37 GMT

Hi,

I am trying to mask dataat index time, can you please help ?

First line is a result and second is what i would like to be.

Thx

"authenticationValue":"AAcBBGJxFAAAAZZANIJZdQAAAAA=" Result

"authenticationValue":"****************************"

Re: Data masking

gcusello — Mon, 19 Sep 2022 08:00:38 GMT

Hi @egcp,

you can follow the instructions at https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata

You have two methods:

using SEDCMD
using props.conf and transfroms.conf

Using SEDCMD, you have to put in your props.conf:

[your_sourcetype] SEDCMD-xxx = s/"authenticationValue":"\w+"/"authenticationValue":"****************************"/g

Using props.conf and transforms.conf:

props.conf: [your_sourcetype] TRANSFORMS-anonym,izer = session-anonymizer transforms.conf: [session-anonymizer] REGEX = \"authenticationValue\":\"(\w+\)\" FORMAT = \"authenticationValue\":\"(**********)\" DEST_KEY = _raw

there also some videos to teach about this topic in YouTube Splunk channel.

Ciao.

Giuseppe

Re: Data masking

egcp — Mon, 19 Sep 2022 11:36:24 GMT

Hi,

Tried both options , but nothing change in log.

Re: Data masking

gcusello — Mon, 19 Sep 2022 12:12:33 GMT

Hi @egcp,

the first check to perform is on the regex: use the "regex" command to check if the regex is correct

<your_search> | rex mode=sed "SEDCMD-xxx = s/"authenticationValue":"\w+"/"authenticationValue":"****************************"/g"

then, where is this props.conf?

it must be located on the indexers or (if present) on Heavy Forwarders.

Ciao.

Giuseppe

Re: Could someone help me with Data Masking?

egcp — Tue, 20 Sep 2022 10:31:57 GMT

Hi,

props are properly placed.

In search also nothing is changed.

Thank you for your effort .