topic Re: Anonymize Data in Splunk Search in Getting Data In

Anonymize Data in Splunk Search

jmaguire1992 — Wed, 09 Mar 2016 11:25:11 GMT

Hey,
I am running a local instance of splunk for testing purposes. The aim is toAnonymize certain parts of the data that can be searched.
In my files there were no props.conf or transforms.conf so I created these two files in this folder

'C:\Program Files\Splunk\etc\system\local'

The data I am looking to anonymize is simple
testfield: 123
- Either by removing it completely or removing the unit.

If anyone could help with what exactly should go in the transforms.conf and the props.conf files that would be greatly appreciated.

Thank you,

Re: Anonymize Data in Splunk Search

somesoni2 — Wed, 09 Mar 2016 18:05:06 GMT

This Splunk doc should get you started.

http://docs.splunk.com/Documentation/Splunk/6.2.8/Data/Anonymizedatausingconfigurationfiles

Re: Anonymize Data in Splunk Search

DMohn — Wed, 09 Mar 2016 18:46:04 GMT

Assuming you want to anonymize the '123' in your test data, you could use the following configuration:

props.conf

 [your_sourcetype]
 TRANSFORMS-anonymize = testdata_anonymizer

transforms.conf

 [testdata_anonymizer]
 REGEX = (?m)^testfield:\s+(.*)$
 FORMAT = testfield:\sxxxx
 DEST_KEY = _raw

This will strip all off your event after the 'testfield: ' string, and replace it with 'xxxx'
If you want to keep some of the data, you have to modify the regex accordingly.

Re: Anonymize Data in Splunk Search

jmaguire1992 — Thu, 10 Mar 2016 09:26:52 GMT

Thank you very much! It worked! It removed all of the other data and just left

testfield:\sxxxx

So I will try figure out some way of modifying the regex to just Anoymize the testfield, but thank you so much for your helpful comment 🙂

Re: Anonymize Data in Splunk Search

jaiminsol — Tue, 12 Sep 2017 15:40:55 GMT

Hi Sir,
Are you able to modify the regex to replace only 123 data . not all other fields in the even. IF yes Could you please provide the regex. Thanks in advance for your help .

Re: Anonymize Data in Splunk Search

DMohn — Tue, 12 Sep 2017 19:55:12 GMT

You can modify the regex to capture only the next three digits after 'testfield:' this way:
REGEX = (?m)testfield:\s+(\d{3})
FORMAT = testfield:\sxxxx

This will capture any string 'testfield:' followed by a space and three digits.