topic Re: Props.conf: Why isn't my mask working? in Getting Data In

Props.conf: Why isn't my mask working?

morphis72 — Wed, 22 Apr 2020 23:38:56 GMT

I'm trying to mask out of the log below and I'm not sure what I'm doing wrong.

log:

[22/Apr/2020:19:29:57 -0400] MODIFY INT conn=88927 op=65 msgID=66 PLUGIN=Modify: modifications: [Modification(replace, Attribute(userPassword, {userpassword})]

my props.conf

[source::mysourcetype]

SEDCMD-mask = ^\[.+\sPLUGIN=Modify: modifications: \[Modification\(replace, Attribute\(userPassword, {.+}(.+)/(userPassword, {#####}\g/1

But, it's not matching and replacing the password with the #####'s

Re: Props.conf: Why isn't my mask working?

kamlesh_vaghela — Thu, 23 Apr 2020 05:12:18 GMT

@morphis72

Can you please try this?

SEDCMD-mask = 's/.*Attribute\(userPassword, {(.*)}\)\]/.*Attribute\(userPassword, {#####}\)\]$/

Re: Props.conf: Why isn't my mask working?

Jawahir — Thu, 23 Apr 2020 05:45:52 GMT

Try this : -

SEDCMD-mask=s/(.*?\(userPassword,\s*{).*(}\)\])/\1####\2/g

Re: Props.conf: Why isn't my mask working?

PavelP — Thu, 23 Apr 2020 05:52:31 GMT

Hello @morphis72

the syntax [source::mysourcetype] is wrong. Either you use [source::mysource] or [sourcetype].

SEDCMD-mask = s/(.*Attribute\(userPassword, {)(.*)(}\)\].*)/\1XXXXX\2/

Let me know how it went.

P.S. SEDCMD works only at index time. You cannot change already indexed data later at search time. SEDCMD should be applied on indexer, HF oder UF if INDEXED_EXTRACTIONS is used.

Re: Props.conf: Why isn't my mask working?

DavidHourani — Thu, 23 Apr 2020 06:00:08 GMT

Hi @morphis72,

The sed command you wrote replaces the entire log line instead of removing the password. Try out your regex here :
https://regex101.com/

Also there is no need to type in the entire log line for sed to match, you can go for something similar as follows :

[password-Anon]
SEDCMD-Anon = s/Attribute\(userPassword, {userpassword}\)/Attribute(userPassword, {xxxxxxxxxxxx})/g

The guide is here if you need more details :
https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata#Anonymize_data_with_a_sed_script

One last thing, make sure the stanza for sourcetype in props.conf is :

[mysourcetype]

and not :

[source::mysourcetype]

Let me know if that helps.

Cheers,
David