topic Re: Why are Props & transforms not taking effect when trying to hide ipclient? in Splunk Search

Why are Props & transforms not taking effect when trying to hide ipclient?

virtuosoo — Tue, 29 Sep 2020 22:04:15 GMT

Hello community,

I am trying to configure my props.conf and transforms.conf to hide ipclient when indexing data. I am doing all the configurations needed, but I find no effect after indexation. And I can't find my hidden values :

NB : I am indexing in a specific app in my project, and I've added in props and transform in the local file of this app, And I am choosing access_combined in the source_type when indexing data.

Here's my props.conf :

[access_combined]
TRANSFORMS-clientipindex = maskip_index

And here's my transforms.conf :

[maskip_index]
FORMAT = clientip_hidden::$1.".".$2.".x.x"     <= Here I am trying to hide the last two numbers of the ip address.
REGEX = ^([0-9]{1,3})\.([^.]*)\.([^.]*)\.([^.]*)
SOURCE_KEY = clientip

Any help please 😄 !

Re: Why are Props & transforms not taking effect when trying to hide ipclient?

sudosplunk — Fri, 16 Nov 2018 15:58:21 GMT

Can you provide some redacted events to see if the issue is with regex. Thx..

Re: Why are Props & transforms not taking effect when trying to hide ipclient?

FrankVl — Fri, 16 Nov 2018 16:14:08 GMT

You are doing a TRANSFORMS on SOURCE_KEY 'clientip'. I don't think that is available as a field at indextime. And anyway such a transforms would not change the raw event, so the ip address would still be fully visible there.

You are probably better off doing a SEDCMD in props.conf (assuming you have the client ip right at the start of your logs, as usual with access_combined I believe).

SEDCMD-mask_ip = s/^(\d{1,3})\.(\d{1,3})\.\d{1,3}\.\d{1,3}/\1.\2.x.x/

Re: Why are Props & transforms not taking effect when trying to hide ipclient?

virtuosoo — Fri, 16 Nov 2018 16:33:16 GMT

You are amazing FrankVl :D...Thank youuuu