Getting Data In

How to build a regular expression in order to mask password text in props.conf?

caitcait
Explorer

I have the following string in the events and I would like to mask the password text using sedcmd.

Content={"Login":"stuff@stuff.com","Password":"thingsandstuff"}

Does anyone have any thoughts how to build the regex to do this?

Thank you

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this

s/("Password":")([^"]+)"/\1XXX"/
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this

s/("Password":")([^"]+)"/\1XXX"/
---
If this reply helps you, Karma would be appreciated.
0 Karma

caitcait
Explorer

works beautifully, thank you!

Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...