How to redact the description field from the Service WinHostMon?

JChris_ — Wed, 26 Oct 2022 00:06:59 GMT

I'm trying to redact the description field from the Service WinHostMon to have something like that:

Before:

Type=Service Name="LoremIpsum" DisplayName="Lipsum service" Description="Bla bla bla bla bla." Path="C:\path\to\software.exe" ServiceType="Unknown" StartMode="Manual" Started=false State="Stopped" Status="OK" ProcessId=123

After:

Type=Service Name="LoremIpsum" DisplayName="Lipsum service" Description="redacted" Path="C:\path\to\software.exe" ServiceType="Unknown" StartMode="Manual" Started=false State="Stopped" Status="OK" ProcessId=123

I have a Windows host running Splunk UF, which then sends the data to a Splunk HF, which then sends it to Splunk Cloud. In the Splunk HF I already tried 2 approaches, both failed:

Approach 1:

Splunk HF > system/local/props.conf

[source::service] SEDCMD-redact=s/\/Description=.+\n/\/Description="redacted"\n/g

Approach 2:

Splunk HF > system/local/props.conf

[source::service] TRANSFORMS-my_transf = remove-desc

Splunk HF > system/local/transforms.conf

[remove-desc] REGEX = (?mi)((?:.|\n)+Description=).+(\n(?:.|\n)+) FORMAT = $1"redacted"$2 DEST_KEY = _raw

So, how can I redact the description field?

Re: WinHostMon Props and Transforms to redact field?

richgalloway — Tue, 25 Oct 2022 23:47:24 GMT

SEDCMD will work with the right regex. Linefeeds are removed by the default line breaker so a regex is unlikely to find them. Try this, instead.

[source::service] SEDCMD-redact=s/Description=".+"/Description="redacted"/

topic Re: WinHostMon Props and Transforms to redact field? in Getting Data In

How to redact the description field from the Service WinHostMon?

Re: WinHostMon Props and Transforms to redact field?