topic Re: Can you mask data at index-time conditionally? in Splunk Search

Can you mask data at index-time conditionally?

twinspop — Tue, 19 Jan 2016 17:52:57 GMT

Given data like this:

v1=1 v2=2 v3=3.45 v4=4 key=bad
v1=6 v2=7 v3=8.45 key=good v4=9

I want to mask the vX values in the case of key=bad only. I cannot guarantee order. Results should be:

v1=x.xx v2=x.xx v3=x.xx v4=x.xx key=bad
v1=6 v2=7 v3=8.45 key=good v4=9

Is this possible?

Re: Can you mask data at index-time conditionally?

alemarzu — Tue, 19 Jan 2016 19:15:20 GMT

Hi twinspop,

Try to follow this example using your sample data.

01/19/2016 11:34 v1=1 v2=2 v3=3.45 v4=4 key=bad
01/19/2016 11:22 v1=6 v2=7 v3=8.45 key=good v4=9

With the given SEDCMD regex below, using Positives Lookbehind/Lookahead.

[your_sourcetype]
SEDCMD = s/(?<=v1=).*(?=\sv2=.*?\skey=bad)/X.XX/g s/(?<=v2=).*(?=\sv3=.*?\sv4=.*?\skey=bad)/X.XX/g s/(?<=v3=).*(?=\sv4=.*?\skey=bad)/X.XX/g s/(?<=v4=)\d(?=\skey=bad)/X.XX/g

Hope it helps.

Re: Can you mask data at index-time conditionally?

twinspop — Tue, 19 Jan 2016 23:22:25 GMT

This might lead to the correct way, but the field names (aside from key) are variable. I should have included that tidbit. 🙂 Reading up on PLBs and PLAs. Thanks!

Re: Can you mask data at index-time conditionally?

twinspop — Tue, 19 Jan 2016 23:53:39 GMT

I'm not able to make this work because the fields that need masking occur an arbitrary number of times. Roughly speaking what I need is:

if (/key=bad/)
    s/v(\d+)=\d+\.\d{2}/v\1=x.xx/g

(this will teach me to use better sample data -- sorry)

Re: Can you mask data at index-time conditionally?

alemarzu — Wed, 20 Jan 2016 20:57:23 GMT

It's okey mate, dont worry about it.

Check this out, based on your sample data again, this regex should match (n) amount of fields.

s/(?<==)(\d+\.\d{1,}+|\d+)(?=.*?key=bad)/X.XX/g

EDIT: regex101 example, https://regex101.com/r/uM9nW8/1