Archive

Anonymize data is not working,

Engager

hello,

I made my Anonymize data based on this http://docs.splunk.com/Documentation/Splunk/7.0.0/Data/Anonymizedata
and I checked it million times.
I have distributed installation and I have done this on "indexer"

[xyz:abc:auto]
TRANSFORMS-anonymize = password-anonymizer

[password-anonymizer]
REGEX = (?m)^(.)Password=\w+%(\w{0}[^&].)$
FORMAT = $1Password=#########$2
DEST_KEY = _raw

Tags (1)
0 Karma

Communicator

Try the following changes:

[password-anonymizer]
REGEX = (?m)^(.*)Password=[^%]*(.*)$
FORMAT = $1Password=#########$2
DEST_KEY = _raw

Please note that this configuration belongs into transforms.conf. The other two lines you posted belong into props.conf.

You will need to restart your indexers after making such changes.

Also make sure that your data has the correct sourcetype assigned. (In your case, that would be "xyz:abc:auto".)

On a more general note, I often use this website for testing purposes when dealing with regex:
https://regex101.com/

0 Karma

Engager

I found out that the indexer doesn't even do anything with the log, it's like it doesn't read the stanza I made.
and I moved it to the top but its the same nothing happened

0 Karma

Communicator

Run the following commands on your indexer to check that Splunk finds your configuration:
/opt/splunk/bin/splunk btool props list
/opt/splunk/bin/splunk btool transforms list
Is your configuration listed here?

Which sourcetype does your data have? If the props.conf stanza is [xyz:abc:auto] as you posted then the sourcetype of your data must be "xyz:abc:auto".

0 Karma

Legend

Hi ahmadjabr,
can you share an example of log to anonymize, your regex isnot so clear?
Bye.
giuseppe

0 Karma

Engager

2017-12-18 07:42:19 10.0.1.1 GET /send.asmx/Send Username=CENTER&Password=asdqweasd%23&Sender=xyyzetc etcetcetectecetetctec

0 Karma

Legend

Hi ahmadjabr,
try a different regex escaping = and %

REGEX = (?m)^.*Password\=\w+\%.*$

Bye.
Giuseppe

0 Karma

Communicator

The link you provided says: "The forwarded data must arrive at the indexer already parsed." Do you perhaps have a heavy forwarder in place?

If you have a heavy forwarder in place, move your anonymization configuration from the indexers to the heavy forwarders.

0 Karma

Engager

I don't have heavy forwarder I have universal forwarder, will it work?
and universal forwarder on the windows machine

0 Karma

Communicator

Universal forwarders do not parse the data. So keep this configuration on the indexers.

0 Karma