topic Re: Anonymize data is not working, in Getting Data In

Anonymize data is not working,

ahmadjabr — Mon, 18 Dec 2017 08:11:43 GMT

hello,

I made my Anonymize data based on this http://docs.splunk.com/Documentation/Splunk/7.0.0/Data/Anonymizedata
and I checked it million times.
I have distributed installation and I have done this on "indexer"

[xyz:abc:auto]
TRANSFORMS-anonymize = password-anonymizer

[password-anonymizer]
REGEX = (?m)^(.)Password=\w+%(\w{0}[^&].)$
FORMAT = $1Password=#########$2
DEST_KEY = _raw

Re: Anonymize data is not working,

Yunagi — Mon, 18 Dec 2017 08:35:46 GMT

The link you provided says: "The forwarded data must arrive at the indexer already parsed." Do you perhaps have a heavy forwarder in place?

If you have a heavy forwarder in place, move your anonymization configuration from the indexers to the heavy forwarders.

Re: Anonymize data is not working,

gcusello — Mon, 18 Dec 2017 09:10:31 GMT

Hi ahmadjabr,
can you share an example of log to anonymize, your regex isnot so clear?
Bye.
giuseppe

Re: Anonymize data is not working,

ahmadjabr — Mon, 18 Dec 2017 09:49:35 GMT

I don't have heavy forwarder I have universal forwarder, will it work?
and universal forwarder on the windows machine

Re: Anonymize data is not working,

ahmadjabr — Mon, 18 Dec 2017 09:54:39 GMT

2017-12-18 07:42:19 10.0.1.1 GET /send.asmx/Send Username=CENTER&Password=asdqweasd%23&Sender=xyyzetc etcetcetectecetetctec

Re: Anonymize data is not working,

Yunagi — Mon, 18 Dec 2017 10:22:34 GMT

Universal forwarders do not parse the data. So keep this configuration on the indexers.

Re: Anonymize data is not working,

Yunagi — Mon, 18 Dec 2017 10:42:11 GMT

Try the following changes:

[password-anonymizer]
REGEX = (?m)^(.*)Password=[^%]*(.*)$
FORMAT = $1Password=#########$2
DEST_KEY = _raw

Please note that this configuration belongs into transforms.conf. The other two lines you posted belong into props.conf.

You will need to restart your indexers after making such changes.

Also make sure that your data has the correct sourcetype assigned. (In your case, that would be "xyz:abc:auto".)

On a more general note, I often use this website for testing purposes when dealing with regex:
https://regex101.com/

Re: Anonymize data is not working,

gcusello — Mon, 18 Dec 2017 10:42:59 GMT

Hi ahmadjabr,
try a different regex escaping = and %

REGEX = (?m)^.*Password\=\w+\%.*$

Bye.
Giuseppe

Re: Anonymize data is not working,

ahmadjabr — Tue, 19 Dec 2017 09:38:24 GMT

I found out that the indexer doesn't even do anything with the log, it's like it doesn't read the stanza I made.
and I moved it to the top but its the same nothing happened

Re: Anonymize data is not working,

Yunagi — Tue, 19 Dec 2017 09:53:11 GMT

Run the following commands on your indexer to check that Splunk finds your configuration:
/opt/splunk/bin/splunk btool props list
/opt/splunk/bin/splunk btool transforms list
Is your configuration listed here?

Which sourcetype does your data have? If the props.conf stanza is [xyz:abc:auto] as you posted then the sourcetype of your data must be "xyz:abc:auto".