topic Re: How to mask data for a particular field in Dashboards & Visualizations

How to mask data for a particular field?

power12 — Mon, 06 Mar 2023 20:01:15 GMT

Hello Splunkers ,

I have the following sample data .I want to mask the data after VIN(bold) to xxxxxx before indexing .Also if the data is already ingested before need to. mask it on dashboards .I know SED command is used but I dont know how to use that

search ownership for claimnumber = " ----" with request payload={

"tID" : ---------------

"adminInfo" : {

"cNumber" : " --------",

"ier" : " -----",

"dateofloss": "------",

"vehicleinformation": {

"vin": "2323213123123" ,

"vee": "A"

}

"tis":{

"state":"XYZ"

"on": "N"

"county":"-------"

}

Thanks in Advance

Re: How to mask data for a particular field

gcusello — Mon, 06 Mar 2023 16:30:05 GMT

Hi @power12,

if you want to replace the number after "vin" with some "XXXXXXXXXX", you have to use in props.conf:

[your_sourcetype] SEDCMD-mask = s/\"vin\":\s+\"\d+\"/\"vin\":\s+\"XXXXXXXXXX\"/g

this props.conf must be located on Indexers or (uf present) on heavy Forwarders.

Ciao.

Giuseppe

Re: How to mask data for a particular field

power12 — Mon, 06 Mar 2023 20:09:57 GMT

@gcusello I tried using the one you sent in props.conf .It looks like below.

\"vin\":\s+\"XXXXXXXXXX\" ,

It should be
"vin": "XXXXXXX" ,

Re: How to mask data for a particular field

gcusello — Tue, 07 Mar 2023 06:41:05 GMT

Hi @power12,

you can test the regex also using the rex command in a search:

<your_search> | rex mode=sed "s/\"vin\":\s+\"\d+\"/\"vin\": \"XXXXXXXXXX\"/g"

and it runs in my test

could you share the props.conf you used?

Ciao.

Giuseppe

Re: How to mask data for a particular field

power12 — Thu, 09 Mar 2023 20:43:39 GMT

@gcusello It worked I think I had a typo

Re: How to mask data for a particular field

gcusello — Fri, 10 Mar 2023 07:26:03 GMT

Hi @power12,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉