topic Mask partial value in Splunk _raw Data using SED in Getting Data In

Mask partial value in Splunk _raw Data using SED

Shashank_87 — Wed, 22 May 2019 09:40:45 GMT

Hi, I have the below event in my splunk logs and i want to partially mask few things -
1. I want to just remove the IP's which is at the end of 2nd line - 12.12.12.12
2. I want to partially mask the digits in between from this - number: 441234567809. Like 44******809.
And i want to do this in _raw events because i will be exporting the _raw file from Splunk after masking

--5f72c-A--
[21/May/2019:23:55:01 +0100] dffsdfsdfds129.654.234.92 5666 12.12.12.12
--5472c-B--
GET /testHTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8
Accept-Encoding: gzip
User-Agent: okhttp/3.10.0
number: 441234567809

Can someone please guide how to do this using sed command?

Re: Mask partial value in Splunk _raw Data using SED

Shashank_87 — Wed, 22 May 2019 11:00:14 GMT

Just to add on to the above :
I am using this but it is masking both the IP's but i only want to mask the 2nd IP which is at the end of that line -
| rex field=_raw mode=sed "s/(\d+.\d+.+\d+.\d+)/****/g"

Re: Mask partial value in Splunk _raw Data using SED

harsmarvania57 — Wed, 22 May 2019 13:55:40 GMT

Hi,

If you want to mask data at search time you can use below regex.

<yoursearch>
| rex field=_raw mode=sed "s/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\v)/\1/"
| rex field=_raw mode=sed "s/(number\:\s\d{2})\d+(\d{3})/\1***\2/"

Re: Mask partial value in Splunk _raw Data using SED

somesoni2 — Wed, 22 May 2019 14:58:59 GMT

All this is part of single event? Do you want to mask the data at index time OR search time?