topic Re: Replace _raw data for the matched string pattern in a multiple lines raw data in Splunk Search

Replace _raw data for the matched string pattern in a multiple lines raw data

dwangfeng — Tue, 07 Jan 2025 16:45:29 GMT

Here is my raw data in the splunk query

<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"> <s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <application xmlns="http://www.abc.com/services/listService"> <header> <user>def@ghi.com</user> <password>al3yu2430nald</password>

If I want to mask the password value and show in the splunk output as:
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"> <s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <application xmlns="http://www.abc.com/services/listService"> <header> <user>def@ghi.com</user> <password>xxxxxxxxxxxx</password>

How can I do that?

Re: Replace _raw data for the matched string pattern in a multiple lines raw data

kiran_panchavat — Tue, 07 Jan 2025 18:54:45 GMT

@dwangfeng Can you try this

I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.

Please, don't forget to accept this solution if it fits your needs.

Re: Replace _raw data for the matched string pattern in a multiple lines raw data

kiran_panchavat — Tue, 07 Jan 2025 18:23:45 GMT

@dwangfeng

index="yourindex" sourcetype="yoursourcetype"
| rex mode=sed "s/<password>[^<]+<\/password>/<password>xxxxxxxxxxxx<\/password>/g"

I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.

Please, don't forget to accept this solution if it fits your needs.

Re: Replace _raw data for the matched string pattern in a multiple lines raw data

kiran_panchavat — Tue, 07 Jan 2025 18:53:34 GMT

@dwangfeng

Apply this props.conf

[<sourcetype>]
SEDCMD-splunktestdata = s/(?i)(<password>)[^<]+(<\/password>)/\1xxxxxxxxxxxx\2/g

Re: Replace _raw data for the matched string pattern in a multiple lines raw data

dwangfeng — Tue, 07 Jan 2025 18:54:36 GMT

Thank you @kiran_panchavat . your solution works great.

Re: Replace _raw data for the matched string pattern in a multiple lines raw data

isoutamo — Wed, 08 Jan 2025 18:16:10 GMT

even you can mask that data in GUI, it didn't mean that you have really masked that data in Splunk. You must remember that after you have write it into bucket then it there and there is always a way to get it out in plain text if/when you have access to GUI and can write SPL. Even you are using search time props.conf and transforms.conf.

The only way is remove that data from index and reindex it again. And even the delete command is not enough if you have access to buckets on CLI level, you could get thet data back. The only way is let it go away with set frozen time enough low, then wait and then reindex it.

r. Ismo