topic Re: How to mask passwords from splunk logs? in Getting Data In

How to mask passwords from splunk logs?

ssyed2009 — Tue, 27 Feb 2018 18:15:05 GMT

time: 20180227120538
... 1 line omitted ...
changetype: modify
replace: userPassword
userPassword: {1234}

Currently, I am trying under props.conf but it doesn't seem to work.

SEDCMD-masking = s/\suserPassword:\s\S+/\suserPassword:\s/################################################/

Re: How to mask passwords from splunk logs?

mdsnmss — Tue, 27 Feb 2018 19:43:50 GMT

You can try a combination of props.conf and transforms.conf: https://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Anonymizedata

props.conf

[<spec>]
TRANSFORMS-mask = password-masker

transforms.conf

[password-masker]
REGEX = (?m)^(.*)userPassword:\s(\S+)(.*)$
FORMAT = $1userPassword: ################################################$3
DEST_KEY = _raw

Re: How to mask passwords from splunk logs?

mdsnmss — Tue, 27 Feb 2018 19:47:52 GMT

The SEDCMD is also an option which is what you are attempting. It looks like your regex may be missing for "/g" flag for replacing matches.

Re: How to mask passwords from splunk logs?

mdsnmss — Tue, 27 Feb 2018 19:51:29 GMT

SEDCMD-masking = s/suserPassword:\s\S+/suserPassword:\s/################################################\1/g

You may also want to reduce the number of "#" if that isn't of importance. You don't want to necessarily make your data size larger.

Re: How to mask passwords from splunk logs?

ssyed2009 — Wed, 28 Feb 2018 18:40:10 GMT

I tried the above transform and props config and it is modifying the whole event and just showing

userPassword: ################################################

Re: How to mask passwords from splunk logs?

mdsnmss — Wed, 28 Feb 2018 18:51:30 GMT

Is this your full event you are trying to modify?

time: 20180227120538
... 1 line omitted ...
changetype: modify
replace: userPassword
userPassword: {1234}

It's likely having issues with the multiline format. Try the regex (?s)(.*)userPassword:\s(\S+)(.*)$