Getting Data In

How to build a regular expression in order to mask password text in props.conf?

Explorer

I have the following string in the events and I would like to mask the password text using sedcmd.

Content={"Login":"stuff@stuff.com","Password":"thingsandstuff"}

Does anyone have any thoughts how to build the regex to do this?

Thank you

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this

s/("Password":")([^"]+)"/\1XXX"/
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try this

s/("Password":")([^"]+)"/\1XXX"/
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Explorer

works beautifully, thank you!