topic Re: Help with data masking in Getting Data In

Help with data masking

vrmandadi — Tue, 06 Aug 2019 14:38:51 GMT

Below is the sample mocked up data .I want to mask the the ones's highlighted .The sample data is part of an event which is more than 300 lines

"status": 1,
"parentGoalId": 5133,
"account": {
"goalId": 0,
"accountType": "regular",
"accountOpenDate": "0001-01-01T00:00:00",
"isAccountOpeningInProgress": true,
"owner": {
"firstName": "abc",
"middleName": "xyz",
"lastName": "eee",
"dateOfBirth": "1/1/2000 12:00:00 AM",
"ssn": "099999999",
"citizenship": "alien",
"isMailingAddressAsPhysical": false,
"isTextMessageNotificationEnabled": false,

Re: Help with data masking

mayurr98 — Tue, 06 Aug 2019 16:29:11 GMT

You could probably use below link to anonymize data at index time.
https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/Data/Anonymizedata#Define_the_sed_script_in_props.conf

and try s/(\"firstName\":\s+\")\w+/\1xxx/g for every field. Use the same for every field just change the name in round brackets and it should work.

Before this I would recommend you to try this in search time using rex on your prod data to see if it actually what you want.

This is sample run anywhere search

| makeresults | eval data="\"owner\": {
\"firstName\": \"abc\",
\"middleName\": \"xyz\",
\"lastName\": \"eee\",
\"dateOfBirth\": \"1/1/2000 12:00:00 AM\",
\"ssn\": \"099999999\",
\"citizenship\": \"alien\"," | rex field=data mode=sed "s/(\"firstName\":\s+\")\w+/\1xxx/g" | rex field=data mode=sed "s/(\"middleName\":\s+\")\w+/\1xxx/g"

You should use rex command given above on your prod data and see if it is actually working.

Let me know if this helps!

Re: Help with data masking

vrmandadi — Tue, 06 Aug 2019 18:10:21 GMT

Hello Mayurr,

Thank you for your response I tries using the rex for date of birth s/(\"dateOfBirth\":\s+\")\w+/\1xxx/g .This only masked the part before the first / like xxx/1/2000 12:00:00 AM

Re: Help with data masking

mayurr98 — Tue, 06 Aug 2019 18:24:34 GMT

Try this for date of birth:

| rex field=data mode=sed "s/(\"dateOfBirth\":\s+\")[^\"]+/\1xxx/g"

Pls accept if it works for you to close this question.

Re: Help with data masking

vrmandadi — Tue, 06 Aug 2019 19:08:41 GMT

Thank You it worked