topic Re: Anonymize Multiple Data Points in Splunk Search in Getting Data In

Anonymize Multiple Data Points in Splunk Search

markhvesta — Wed, 30 Sep 2020 01:56:29 GMT

I am trying to anonymize customer credit card data in splunk logs but when more than one card appears in the same event only one is scrubbed.

transforms on the indexers:

[SEDCMD-anonymizecc]
REGEX =  s/(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|6(?:011|5[0-9][0-9])[0-9]{12}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|(?:2131|1800|35\d{3})\d{11})/###SCRUBBED###/g
FORMAT= $1###SCRUBBED###$2
REPEAT_MATCH = true
LOOKAHEAD = 800

Sample event:

2019-08-27 13:31:00,002 -0700 DEBUG -
Sent Message HTTP POST
Elapsed time : 0.007166 (seconds)
ContentType : application/x_www_form_urlencoded
Request : Amount = 528.01
CardNumber = CARDNUMBER
PaymentDeviceOnFileID =
ResponseCode = 0
Request Buffer : Amount=528.01&CardNumber=CARDNUMBER&PaymentDeviceOnFileID=##NULL##
Response Buffer : ResponseCode=0

Re: Anonymize Multiple Data Points in Splunk Search

harsmarvania57 — Wed, 28 Aug 2019 08:34:38 GMT

Hi,

You can use SEDCMD in props.conf to achieve this easily at Index time, compare to combination of props and transforms.

Please try below config

props.conf

[yourSourcetype]
SEDCMD-Anon = s/(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|6(?:011|5[0-9][0-9])[0-9]{12}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|(?:2131|1800|35\d{3})\d{11})/###SCRUBBED###/g

Re: Anonymize Multiple Data Points in Splunk Search

markhvesta — Wed, 28 Aug 2019 15:42:53 GMT

I just tried this and it is only masking the second instance and not the first in the event.