topic Re: Masking account numbers in Getting Data In

Masking account numbers

KarlGechlik — Wed, 21 Sep 2011 17:37:38 GMT

Hello we are trying to mask an account#'s last 5 digits. I have added this to props.conf

[annon]
TRANSFORMS-anonymize = hideacct-number

and this to transforms.conf

[hideacct-number]
REGEX=(.*AcctCode=\d{5}-).*
FORMAT=$1xxxxx

I stopped splunk and cleaned the index and then started it again and the account numbers are still there completely. What are we missing?

Update: I am using 4.2.3 and I am trying to mask the last 5 characters with X's. I am trying JSapienza's answer now and will keep you posted. Thanks!

Update2: That did not help. It does not change my data. I tried REPORT as well with the same results.

Re: Masking account numbers

JSapienza — Wed, 21 Sep 2011 18:15:42 GMT

If I'm not mistaken, I think you need to set the DEST_KEY = _raw so the indexer knows to mask at index time from the raw event.

Re: Masking account numbers

gekoner — Wed, 21 Sep 2011 18:16:05 GMT

Karl,
Can you provide some additional information? It is always helpful to understand what version you are running.

Also can explain in a little more detail what you are trying to do? Are you attempting to take an account number that is in the format ##### to replace the "numbers" with "xxxxx"?

Re: Masking account numbers

KarlGechlik — Wed, 21 Sep 2011 18:25:29 GMT

This did not help. I added this to transforms.conf and it still does not modify the data in the field at all.

Re: Masking account numbers

KarlGechlik — Mon, 28 Sep 2020 09:53:44 GMT

Turns out it was a combination of JSapienza's answer and removing my header in props.conf:

props.conf:

EXTRACT- = .TraderID:(?.)

TRANSFORMS = hideacct-number

transforms.conf:

[hideacct-number]
DEST_KEY =_raw
REGEX=(.AcctCode=\d{5}-).
FORMAT=$1xxxxx

and apparently the DEST_KEY =_raw needs to be at the top of transforms.conf

Re: Masking account numbers

dwaddle — Wed, 21 Sep 2011 19:53:56 GMT

Another, perhaps simpler, way of accomplishing this is by using SEDCMD. See http://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedatawithsed

Re: Masking account numbers

MicroAlpha — Fri, 20 Mar 2015 13:48:46 GMT

Another way, albeit external and not free, is with a third-party masking tool for the data sources you would index into Splunk. I found this:

http://www.iri.com/blog/data-protection/secure-then-splunk-a-format-preserving-encryption-and-pseduonymization-example/