Help with data masking

[vrmandadi]

Below is the sample mocked up data .I want to mask the the ones's highlighted .The sample data is part of an event which is more than 300 lines

"status": 1,
"parentGoalId": 5133,
"account": {
"goalId": 0,
"accountType": "regular",
"accountOpenDate": "0001-01-01T00:00:00",
"isAccountOpeningInProgress": true,
"owner": {
"firstName": "abc",
"middleName": "xyz",
"lastName": "eee",
"dateOfBirth": "1/1/2000 12:00:00 AM",
"ssn": "099999999",
"citizenship": "alien",
"isMailingAddressAsPhysical": false,
"isTextMessageNotificationEnabled": false,

[mayurr98 · Accepted solution]

You could probably use below link to anonymize data at index time.
https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/Data/Anonymizedata#Define_the_sed_script_in_...

and try s/(\"firstName\":\s+\")\w+/\1xxx/g for every field. Use the same for every field just change the name in round brackets and it should work.

Before this I would recommend you to try this in search time using rex on your prod data to see if it actually what you want.

This is sample run anywhere search

| makeresults | eval data="\"owner\": {
\"firstName\": \"abc\",
\"middleName\": \"xyz\",
\"lastName\": \"eee\",
\"dateOfBirth\": \"1/1/2000 12:00:00 AM\",
\"ssn\": \"099999999\",
\"citizenship\": \"alien\"," | rex field=data mode=sed "s/(\"firstName\":\s+\")\w+/\1xxx/g" | rex field=data mode=sed "s/(\"middleName\":\s+\")\w+/\1xxx/g"

You should use rex command given above on your prod data and see if it is actually working.

Let me know if this helps!

[vrmandadi]

Hello Mayurr,

Thank you for your response I tries using the rex for date of birth s/(\"dateOfBirth\":\s+\")\w+/\1xxx/g .This only masked the part before the first / like xxx/1/2000 12:00:00 AM

[mayurr98]

Try this for date of birth:

| rex field=data mode=sed "s/(\"dateOfBirth\":\s+\")[^\"]+/\1xxx/g"

Pls accept if it works for you to close this question.

[vrmandadi]

Thank You it worked