Dashboards & Visualizations

How to mask data for a particular field?

power12
Communicator

Hello Splunkers ,

I have the following sample data .I want to mask the data after VIN(bold) to xxxxxx before indexing .Also if the data is already ingested before need to. mask it on dashboards .I know SED command is used but I dont know how to use that 

 

search ownership for claimnumber = " ----" with request payload={

"tID" : ---------------
"adminInfo" : {
},
"cNumber" : " --------",
"ier" : " -----",
"dateofloss": "------",
"vehicleinformation": {
"vin":  "2323213123123" ,
"vee": "A"
}
"tis":{
"state":"XYZ"
},
"on": "N"
"county":"-------"
}
 
 
Thanks in Advance
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @power12,

you can test the regex also using the rex command in a search:

<your_search>
| rex mode=sed "s/\"vin\":\s+\"\d+\"/\"vin\": \"XXXXXXXXXX\"/g"

and it runs in my test

gcusello_0-1678171211324.png

could you share the props.conf you used?

Ciao.

Giuseppe

 

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @power12,

if you want to replace the number after "vin" with some "XXXXXXXXXX", you have to use in props.conf:

[your_sourcetype]
SEDCMD-mask = s/\"vin\":\s+\"\d+\"/\"vin\":\s+\"XXXXXXXXXX\"/g

this props.conf must be located on Indexers or (uf present) on heavy Forwarders.

Ciao.

Giuseppe

0 Karma

power12
Communicator

@gcusello I tried using the one you sent in props.conf .It looks like below.


\"vin\":\s+\"XXXXXXXXXX\" ,

 

It should be 
"vin": "XXXXXXX" ,

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @power12,

you can test the regex also using the rex command in a search:

<your_search>
| rex mode=sed "s/\"vin\":\s+\"\d+\"/\"vin\": \"XXXXXXXXXX\"/g"

and it runs in my test

gcusello_0-1678171211324.png

could you share the props.conf you used?

Ciao.

Giuseppe

 

0 Karma

power12
Communicator

@gcusello  It worked I think I had a typo

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @power12,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated :winking_face:

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...