topic Re: How can i mask this data at index time? in Splunk Search

How can i mask this data at index time?

u2s1e0n2 — Mon, 10 Apr 2017 03:21:33 GMT

I will like to mask this data so that the password value is "XXXXXXXX". I have tried SEDCMD, scrub and transforms but I just couldn't get it done. Thanks for your help

Re: How can i mask this data at index time?

koshyk — Tue, 29 Sep 2020 13:35:20 GMT

Index time means you can never recover the value again. Splunk's official documentation to anonymize data

Create an app (eg my_mask_app)
within "local" directory, create inputs.conf and assign a good sourcetype for your dataset (eg probable_password_sourcetype)
within "local" directory, create props.conf and put the value for the above sourcetype

Example

[probable_password_sourcetype]
TRANSFORMS-anonymize = password-anonymizer

Now create transforms.conf in "local" and put the regex logic. Below is a sample only

Example

[password-anonymizer]
REGEX = (?m)^(.*)password=\w+(\w{4}[&"].*)$
FORMAT = $1password=########$2
DEST_KEY = _raw

Re: How can i mask this data at index time?

u2s1e0n2 — Tue, 11 Apr 2017 06:20:53 GMT

Thanks @ koshyk for the insight. But I'm still having issues getting the sample data masked at index time.

Sample data to be masked : ns2:arg name="password" value="utTSsgTST9B"/
props.conf
[password_log]
TRANSFORMS-anonymize = password-anonymizer

transforms.conf
[password-anonymizer]
REGEX = (?m)^(.)"password"=\s\w+('[a-z0-9#])["/].)$
FORMAT = $1password=########$2
DEST_KEY = _raw

What am i doing wrong?
Thanks
-u

Re: How can i mask this data at index time?

koshyk — Tue, 11 Apr 2017 07:55:36 GMT

Good to see a sample data. Your regex seems wrong

Have a try below.

[password-anonymizer]
REGEX =(?m)^(.+)\svalue=\"([\w\W]+)\"(.*)$
FORMAT = $1 value=########$3
DEST_KEY = _raw

Re: How can i mask this data at index time?

u2s1e0n2 — Tue, 11 Apr 2017 14:19:03 GMT

Thanks. It worked.

Re: How can i mask this data at index time?

DMohn — Tue, 11 Apr 2017 14:39:55 GMT

Please mark the answer as accepted if this works for you 😉