topic Re: Problem anonymizing data in Splunk in Getting Data In

Problem anonymizing data in Splunk

justynap_ldz — Tue, 09 Feb 2021 11:36:46 GMT

We want to anonymize the usernames in the following event using sed script.

Raw event:

{"externalId": null, "statusChanged": "2021-02-09T09:51:42.000Z", "userName": "thisisatestuser@123.pl ", "appid": "0oa97rn2ymPrbgM430x612344", "lastUpdated": "2021-02-09T09:51:42.000Z", "scope": "", "userid": "00u1a2mn8ouOvSO2A0x71234", "created": "2021-02-09T09:51:42.000Z", "status": "ACTIVE"}

However, either the stanza in props.conf is incorrect or we did it in the wrong place.

Current config:
1. input is specified on a Heavy Forwarder in an app local folder (we just activated inputs after installing an app in the FrontEnd and that is how this entry was created)
2. we added the following SEDCMD stanza in /opt/splunk/etc/system/local/props.conf on a Heavy Forwarder:

[testapp:appUser]
SEDCMD-TestApp_username1=s/userName:(\d{6})/userName:XXXXXX/1

Does anyone have any idea on how to solve it?

Re: Problem anonymizing data in Splunk

ITWhisperer — Tue, 09 Feb 2021 11:53:14 GMT

Your user name looks like an e-mail address whereas your sed is looking for 6 digits.

Re: Problem anonymizing data in Splunk

to4kawa — Tue, 09 Feb 2021 12:24:38 GMT

index=_internal | head 1 | fields _raw | eval _raw="{\"externalId\": null, \"statusChanged\": \"2021-02-09T09:51:42.000Z\", \"userName\": \"thisisatestuser@123.pl \", \"appid\": \"0oa97rn2ymPrbgM430x612344\", \"lastUpdated\": \"2021-02-09T09:51:42.000Z\", \"scope\": \"\", \"userid\": \"00u1a2mn8ouOvSO2A0x71234\", \"created\": \"2021-02-09T09:51:42.000Z\", \"status\": \"ACTIVE\"}" | rex mode=sed "s/(userName\":\s*\").*@/\1XXXXXX@/"

your SEDCMD is wrong.