Getting Data In

Anonymize Data in Splunk Search

jmaguire1992
Explorer

Hey,
I am running a local instance of splunk for testing purposes. The aim is toAnonymize certain parts of the data that can be searched.
In my files there were no props.conf or transforms.conf so I created these two files in this folder

'C:\Program Files\Splunk\etc\system\local'

The data I am looking to anonymize is simple
testfield: 123
- Either by removing it completely or removing the unit.

If anyone could help with what exactly should go in the transforms.conf and the props.conf files that would be greatly appreciated.

Thank you,

0 Karma
1 Solution

DMohn
Motivator

Assuming you want to anonymize the '123' in your test data, you could use the following configuration:

props.conf

 [your_sourcetype]
 TRANSFORMS-anonymize = testdata_anonymizer

transforms.conf

 [testdata_anonymizer]
 REGEX = (?m)^testfield:\s+(.*)$
 FORMAT = testfield:\sxxxx
 DEST_KEY = _raw

This will strip all off your event after the 'testfield: ' string, and replace it with 'xxxx'
If you want to keep some of the data, you have to modify the regex accordingly.

View solution in original post

DMohn
Motivator

Assuming you want to anonymize the '123' in your test data, you could use the following configuration:

props.conf

 [your_sourcetype]
 TRANSFORMS-anonymize = testdata_anonymizer

transforms.conf

 [testdata_anonymizer]
 REGEX = (?m)^testfield:\s+(.*)$
 FORMAT = testfield:\sxxxx
 DEST_KEY = _raw

This will strip all off your event after the 'testfield: ' string, and replace it with 'xxxx'
If you want to keep some of the data, you have to modify the regex accordingly.

jmaguire1992
Explorer

Thank you very much! It worked! It removed all of the other data and just left

testfield:\sxxxx

So I will try figure out some way of modifying the regex to just Anoymize the testfield, but thank you so much for your helpful comment 🙂

0 Karma

jaiminsol
New Member

Hi Sir,
Are you able to modify the regex to replace only 123 data . not all other fields in the even. IF yes Could you please provide the regex. Thanks in advance for your help .

0 Karma

DMohn
Motivator

You can modify the regex to capture only the next three digits after 'testfield:' this way:
REGEX = (?m)testfield:\s+(\d{3})
FORMAT = testfield:\sxxxx

This will capture any string 'testfield:' followed by a space and three digits.

0 Karma

somesoni2
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...