topic Re: Regex Help! in Splunk Search

Help masking data and regex?

kc_prane — Thu, 17 Feb 2022 00:12:21 GMT

Hi All,

Can someone please help me in masking data and regex? currently, we have an event where I need to mask certain data in a field extraction. I have already worked on the basic regex forSample1 | rex field=_raw "("PAE"\/)(?<Mask_Data>\d+\W\w+\d\s)" but I am looking for a common or a separate regex for all the below samples and I want the events but mask the numbers before " : : " and after / I am good I can get only the numbers masked in the tail.

EVENT Samples

1) Request_URL=ghghghghghhghghghhghg/eeeee/xxx/functionalPAE/188888/WWEE1112: :

2) Request_URL=ghghghghghhghghghhghg/eeeee/xxx/functionalAssessment/188888/EEE3456823947 : :

3)Request_URL=ghghghghghhghghghhghg/eeeee/xxx/functionalAssessmentFromEEF/11111233 : :

4) Request_URL=ghghghghghhghghghhghg/eeeee/xxx/functionalAssessmentFromservices/1333/11233 : :

Thanks in advance.

Re: Regex Help!

VatsalJagani — Wed, 16 Feb 2022 05:40:56 GMT

Based on the samples I'm assuming you want want to mask numbers and alphabets between / and ::.

I'm assuming there are no spaces or other characters in between them.

Write below the line in the props.conf under the right sourcetype stanza. (on the parsing instance, if you collect data on HF, put it on HF, if you collect data on UF and send it to Indexer then put it on Indexers, if you don't understand where to put I would put the configuration everywhere)

SEDCMD-maskvalues = s/\/(\w|\d)+::/\/#####::/g

This should mask the values in your event before it ingests in Splunk. Because I made some assumptions it is a good idea that you do a test before you apply it on production.

Re: Regex Help!

kc_prane — Wed, 16 Feb 2022 06:22:32 GMT

Appreciate your help on the details @VatsalJagani. yes, we do have space after the /digit"space": : but I can add "s " in the provided query. Is there a way we can use get the regex on the UI for masking? cause I don't have access to the backend servers.

Re: Regex Help!

VatsalJagani — Wed, 16 Feb 2022 06:24:09 GMT

Yes.

| rex mode=sed "s/\/(\w|\d)+::/\/#####::/g"

------

@kc_prane - Please upvote and accept the solution if this answers your questions.

Re: Regex Help!

kc_prane — Wed, 16 Feb 2022 15:18:27 GMT

Thanks a lot Vatsal Jagani !