topic Re: Masking sensitive information from event in Getting Data In

Masking sensitive information from event

payal4296 — Tue, 15 Sep 2020 11:36:48 GMT

Hi,I am trying to remove some of the sensitive information to be indexed by Splunk.

But these configurations are not working ,even after getting the configuration reflected over btool and validating the regex over SPL.

Anyone can assist?

props.conf
[o365:management:activity]
TRANSFORMS-anonymize = info-anonymizer
KV_MODE = json
TRUNCATE = 10485760

transforms.conf
[info-anonymizer]
DEST_KEY = _raw
FORMAT = $1$2
REGEX = (.*\"SensitiveInformationDetections\"\:\s\{)\"DetectedValues\"\:\s\[.*\]\,\s(\"ResultsTruncated\"\:.*)

Have already Validated regex over SPL, It is working fine.

|regex _raw="(.*\"SensitiveInformationDetections\"\:\s\{)\"DetectedValues\"\:\s\[.*\]\,\s(\"ResultsTruncated\"\:.*)"

and

|rex field=_raw "(?<before>.*\"SensitiveInformationDetections\"\:\s\{)\"DetectedValues\"\:\s\[.*\]\,\s(?<after>\"ResultsTruncated\"\:.*)"
|eval _raw=before+""+after

Re: Masking sensitive information from event

richgalloway — Tue, 15 Sep 2020 12:48:07 GMT

Recall that btool shows the configuration on disk. Did you restart Splunk after changing the config files?

Re: Masking sensitive information from event

payal4296 — Tue, 15 Sep 2020 14:25:43 GMT

Yes have restarted the splunk service after applying changes to the conf files.

Actually it did worked on Friday ,the day changes were applied but it is not working after that .

Re: Masking sensitive information from event

richgalloway — Tue, 15 Sep 2020 14:47:25 GMT

So the key is to find out what changed since Friday. Use btool to verify the configuration is still in place on your indexers/heavy forwarders.

Re: Masking sensitive information from event

payal4296 — Tue, 15 Sep 2020 15:39:18 GMT

But nothing have changed, the configurations are same in btool.

Re: Masking sensitive information from event

richgalloway — Tue, 15 Sep 2020 16:40:05 GMT

Something must be different. If not the configuration then something else. Could the format of the data have changed since Friday? Perhaps a change was made on the source over the weekend.