Getting Data In

Is there a way to use sedcmd in props.conf to mask firstName, lastName, and birthDate values in my data?

Path Finder

I'm trying to mask birthDate and firstname. For example my Splunk results yields something like....

<firstName>james</firstName>
<lastName>bond</lastName>
<birthDate>01/10/1960</birthDate>

Is there a way to use sedcmd in the props.conf file mask everything between, for example:

<firstName>xxxxxx</firstName> 
<lastName>xxxxxxx</lastName>
<birthDate>xxxxxx</birthDate>

Thanks

0 Karma
1 Solution

Esteemed Legend

Yes, try this:

SEDCMD-firstName= s/(<firstName>).*(<\/firstName>)/\1xxxxxx\2/
SEDCMD-lastName= s/(<lastName>).*(<\/lastName>)/\1xxxxxxx\2/
SEDCMD-birthDate= s/(<birthDate>).*(<\/birthDate>)/\1xxxxxx\2/

View solution in original post

Esteemed Legend

Yes, try this:

SEDCMD-firstName= s/(<firstName>).*(<\/firstName>)/\1xxxxxx\2/
SEDCMD-lastName= s/(<lastName>).*(<\/lastName>)/\1xxxxxxx\2/
SEDCMD-birthDate= s/(<birthDate>).*(<\/birthDate>)/\1xxxxxx\2/

View solution in original post

Path Finder

Thank you.

0 Karma

Legend

Here's some good documentation on how to anonymize data. You can apply this concept to your data to mask first, last and birthdate

http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Anonymizedatausingconfigurationfiles

0 Karma