How to mask data for a particular field?

[power12]

Hello Splunkers ,

I have the following sample data .I want to mask the data after VIN(bold) to xxxxxx before indexing .Also if the data is already ingested before need to. mask it on dashboards .I know SED command is used but I dont know how to use that 

search ownership for claimnumber = " ----" with request payload={

"tID" : ---------------

"adminInfo" : {

},

"cNumber" : " --------",

"ier" : " -----",

"dateofloss": "------",

"vehicleinformation": {

"vin":  "2323213123123" ,

"vee": "A"

}

"tis":{

"state":"XYZ"

},

"on": "N"

"county":"-------"

}

Thanks in Advance

[gcusello]

Hi @power12,

if you want to replace the number after "vin" with some "XXXXXXXXXX", you have to use in props.conf:

[your_sourcetype]
SEDCMD-mask = s/\"vin\":\s+\"\d+\"/\"vin\":\s+\"XXXXXXXXXX\"/g

this props.conf must be located on Indexers or (uf present) on heavy Forwarders.

Ciao.

Giuseppe

[power12]

@gcusello I tried using the one you sent in props.conf .It looks like below.


\"vin\":\s+\"XXXXXXXXXX\" ,

It should be 
"vin": "XXXXXXX" ,

[gcusello · Accepted solution]

Hi @power12,

you can test the regex also using the rex command in a search:

<your_search>
| rex mode=sed "s/\"vin\":\s+\"\d+\"/\"vin\": \"XXXXXXXXXX\"/g"

and it runs in my test

could you share the props.conf you used?

Ciao.

Giuseppe

[power12]

@gcusello  It worked I think I had a typo

[gcusello]

Hi @power12,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉