topic Re: Mask SSN on forwarder/Indexer? in Splunk Search

Mask SSN on forwarder/Indexer?

Giggs — Tue, 29 Sep 2020 15:56:50 GMT

Tried this on both the Forwarder & indexer without success, what am i missing ?

Log output SignUpState='3.30' SSN='555555555'
desired output SSN='xxxxxxxxx'.
Tried this on both the Forwarder & indexer without success, what am i missing ?

Props.conf
[source:://e:\trs\log\accountweb\aw*.log]
SEDCMD-SSN = s/SSN=\d{9})/SSN=xxxxxxxxx\1/g

Props.conf
[source:://e:\trs\log\accountweb\aw*.log]
TRANSFORMS-anonymize = ssn-anonymizer, ssnlookup-anonymizer

Transforms.conf:
[ssn-anonymizer]
REGEX = (?m)(^|)SSN=($|['])[0-9]{9}($|['])
FORMAT = $1SSN=#########'$2
DEST_KEY = _raw
[ssnlookup-anonymizer]
REGEX = (?m)(^|)SSNLookup=($|['])[0-9]{9}($|['])
FORMAT = $1SSNLookup=#########'$2
DEST_KEY = _raw

Re: Mask SSN on forwarder/Indexer?

jkat54 — Tue, 26 Sep 2017 11:24:31 GMT

This:

[source:://e:\trs\log\accountweb\aw*.log]
SEDCMD-SSN = s/SSN=\d{9})/SSN=xxxxxxxxx\1/g

Should be this:

[source:://e:\trs\log\accountweb\aw*.log]
SEDCMD-SSN = s/SSN=\d{9}/SSN=xxxxxxxxx/g

Re: Mask SSN on forwarder/Indexer?

Giggs — Tue, 26 Sep 2017 13:49:08 GMT

Tried this , but still not masking

Re: Mask SSN on forwarder/Indexer?

jkat54 — Tue, 26 Sep 2017 13:59:03 GMT

It needs to be on s heavy forwarder or the indexers. Where did you put it?

Re: Mask SSN on forwarder/Indexer?

Giggs — Tue, 26 Sep 2017 14:22:13 GMT

On thge Indexer

Re: Mask SSN on forwarder/Indexer?

jkat54 — Tue, 26 Sep 2017 20:41:24 GMT

Did you reload your data? Will only apply to new data.