I have a multiline event with two identical keys that I need to mask values for, as shown below. I am NOT especially handy with regex but have manged to get one of the values, the second, masked. Has anyone out there had success masking a multiline event with multiple values like this? Thanks in advance.
2020-02-16 17:00:11,374 [INFO ] pool-1-thread-152 ServiceIdentity - null|null :
OrderNumber: 654321
Ids: 12345678 23456789 34567890
Response: False
manualCapture: False
PostResponses:
specialId: 1234567 <===(1)
relationship: null
nopp: 2
open: False
specialId: 7654321 <===(2)
relationship: null
nopp: 2
open: False
It all depends on what you mean by mask
(and I am not talking about algorithms). Let's assume that you mean to obscure it on the way in. You can do that with something like this on your indexers
:
SEDCMD-obscure_specialId = s/(specialId:\s*)(\d+)/\1***/g
Let's assume that you need to MD5 it on the way in; then you will need something like cribl
.
It all depends on what you mean by mask
(and I am not talking about algorithms). Let's assume that you mean to obscure it on the way in. You can do that with something like this on your indexers
:
SEDCMD-obscure_specialId = s/(specialId:\s*)(\d+)/\1***/g
Let's assume that you need to MD5 it on the way in; then you will need something like cribl
.
Yeah obscure. I'll give it a shot with SED. Thanks for your response!
That worked. The final solution has some additional matches to account for special characters and spaces. Thank you for your response.
s/([s|S]pecial[i|I][d|D]\s*[:|=|[])\s*(\w+)/\1xxxxx/g
You can use an md5 hash function to mask it like this
| eval new_field=md5(FIELD_NAME)
https://docs.splunk.com/Documentation/DSP/1.0.0/DSPFunctionReference/Cryptographic
What regex do you have now?