topic Correct syntax for syslog source in props.conf for SEDCMD in Getting Data In

Correct syntax for syslog source in props.conf for SEDCMD

jbertoli — Thu, 07 Oct 2010 22:37:46 GMT

I would like to ensure that ssn's are anonymized, can anyone tell me what the source type should be for syslog? In the splunk browser the source shows up as udp:514, how should this be added to the source reference in the props.conf file. Cheers jb

[source::.../upd:514]
SEDCMD-accounts = s/ssn=\"\d{3}\-\d{2}\-\d{4}\"/=>\"xxx-xx-xxxx\"/g

Re: Correct syntax for syslog source in props.conf for SEDCMD

ftk — Thu, 07 Oct 2010 23:18:59 GMT

If you want to work off of the source field and the source is indeed udp:514, put this in your props.conf:

[source::udp:514]
SEDCMD-accounts = s/ssn=\"\d{3}-\d{2}-\d{4}\"/=>\"xxx-xx-xxxx\"/g

Or you could work off of whatever sourcetype is assigned to the data. If the sourcetype syslog is assigned, configure props.conf as follows:

[syslog]
SEDCMD-accounts = s/ssn=\"\d{3}-\d{2}-\d{4}\"/=>\"xxx-xx-xxxx\"/g