Getting Data In

Mask partial value in Splunk _raw Data using SED

Shashank_87
Explorer

Hi, I have the below event in my splunk logs and i want to partially mask few things -
1. I want to just remove the IP's which is at the end of 2nd line - 12.12.12.12
2. I want to partially mask the digits in between from this - number: 441234567809. Like 44******809.
And i want to do this in _raw events because i will be exporting the _raw file from Splunk after masking

--5f72c-A--
[21/May/2019:23:55:01 +0100] dffsdfsdfds129.654.234.92 5666 12.12.12.12
--5472c-B--
GET /testHTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8
Accept-Encoding: gzip
User-Agent: okhttp/3.10.0
number: 441234567809

Can someone please guide how to do this using sed command?

0 Karma

somesoni2
Revered Legend

All this is part of single event? Do you want to mask the data at index time OR search time?

0 Karma

harsmarvania57
Ultra Champion

Hi,

If you want to mask data at search time you can use below regex.

<yoursearch>
| rex field=_raw mode=sed "s/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\v)/\1/"
| rex field=_raw mode=sed "s/(number\:\s\d{2})\d+(\d{3})/\1***\2/"
0 Karma

Shashank_87
Explorer

Just to add on to the above :
I am using this but it is masking both the IP's but i only want to mask the 2nd IP which is at the end of that line -
| rex field=_raw mode=sed "s/(\d+.\d+.+\d+.\d+)/****/g"

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...